These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies. This may lead to a buffer overflow condition, causing the web service process to crash or stop responding, resulting in a denial-of-service condition. The vulnerability is due to insufficient input validation before memory copy operations, which can be exploited by [truncated]
A race condition exists in the cloud-based Omada device adoption process of TP-Link Omada devices. An attacker may interact with the adoption workflow before a legitimate device completes registration, potentially resulting in provisioning information being delivered to an attacker. System administrators and security teams should review the CVE record and NVD entry for further details. The CVE record was [truncated]
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. This vulnerability, CVE-2025-15629, was published on 2026-08-03T19:16:40.733Z and has a CVSS score of 6.9, indicating a medium severity. Network administrators and securi [truncated]
The CVE-2025-15627 vulnerability involves a cryptographic weakness in the Omada adoption protocol used by TP-Link Omada products. This weakness stems from the protocol's reliance on hard-coded cryptographic keys for establishing trust and protecting authentication exchanges between controllers and managed devices during device adoption. The potential impact of this vulnerability is that an attacker may be [truncated]
A cryptographic weakness exists in the TP-Link Omada device adoption process. During adoption, site management authentication credentials are transmitted using a weak hashing algorithm that does not provide sufficient protection. This vulnerability could allow an attacker who intercepts adoption-related authentication traffic to recover valid credentials and potentially gain unauthorized access to managed [truncated]
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modi [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T23:17:26.767Z and has not been modified since then. The vulnerability exists in the VPN module of TP-Link AXE75 V1 routers, allowing an adjacent, authenticated attacker to execute arbitrary commands by importing a specially crafted VPN client configuration file. The issue arises from improper fil [truncated]
The CVE-2026-9770 vulnerability affects Tp Link Kasa EC71 v4 and EC70 v4 devices. The firmware for these devices contains a static cryptographic private key stored in a read-only filesystem, which is shared across devices. An attacker with access to the firmware image can extract this key. Successful exploitation may allow an unauthenticated attacker on the same network to compromise the confidentiality o [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-15T01:16:14.620Z and has not been modified since then. This vulnerability, identified in TP-Link Kasa EC70 v4 and EC71 v4, involves an information disclosure issue in the local discovery mechanism. It allows an attacker on the same local network to retrieve geolocation-related data without authentic [truncated]
TP-Link Deco M5 v1 devices are affected by a vulnerability that uses a weak password hashing mechanism to store user credentials. This weakness could allow attackers to perform brute-force or dictionary attacks, potentially leading to unauthorized access to device management functions. The primary security impact is loss of confidentiality. Organizations and individuals using TP-Link Deco M5 v1 devices sh [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T17:16:44.907Z and has not been modified since then. CVE-2026-15429 is a medium-severity vulnerability in the HTTP authentication component of Archer VX1800v v1. The vulnerability allows potential privilege escalation via newline character injection due to improper handling of user-controlled inpu [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T17:16:44.790Z and has not been modified since then. The OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metac [truncated]
An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters. This CVE record was published on 2026-07-14T17:16:44.653Z and has not been modified since then. The vulnerability allows crafted input to be executed as system-level commands, potentially leading to complete compromise of the devic [truncated]
CVE-2026-12760 is a denial-of-service (DoS) vulnerability identified in Tapo C200 v3. The vulnerability is caused by improper handling of IPv4 fragmented packets in the network packet handling logic. An unauthenticated adjacent attacker can exploit this vulnerability by sending crafted packets, leading to excessive resource consumption and device instability. Successful exploitation can trigger a temporar [truncated]
CVE-2026-11834 is a high-severity command injection vulnerability in multiple TP-Link router models. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state. Successful exploitati [truncated]
CVE-2026-11410 is an authenticated OS command injection vulnerability in the BigPond Cable (BPA) WAN configuration module of TL-WR940N v6. This vulnerability allows an attacker with administrative access to execute arbitrary system commands with elevated privileges due to improper sanitization of user input. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. The CVE was publishe [truncated]
CVE-2026-11409 is an authenticated OS command injection vulnerability in the IPv6 PPPoE configuration handler of TL-WR940N v6. Attackers with administrative access can exploit this issue to execute arbitrary system commands with elevated privileges. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. The CVE was published on 2026-06-17 and modified on 2026-06-18. The vendor is li [truncated]
CVE-2026-6250 is an authenticated format string vulnerability in the ONVIF service of Tapo C110 v2. This vulnerability allows a remote authenticated attacker to manipulate stack memory, including control flow data such as return addresses, by interpreting externally controlled data as a format string. Consequently, the attacker may redirect execution flow to existing internal functions, triggering an unau [truncated]
An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters. Successful exploitation of this vulnerabil [truncated]
A command injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes. Successful exploitation may result in a full compromise of confidentiality, integ [truncated]
CVE-2026-6242 is a MEDIUM-severity vulnerability with a CVSS score of 6.8. The vulnerability exists in the ONVIF Subscribe service of Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An authenticated attacker may inject crafted format strings into event subscription requests or notification generation paths to disrupt normal service execution, potentia [truncated]
CVE-2026-6241 is an authenticated format string vulnerability in the ONVIF AddScopes of Tapo C520WS v2. User-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in a DoS condi [truncated]
A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS aff [truncated]
A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service. The device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption. Successful exploitation may cause the ONVIF management service to [truncated]
A logic flaw in the Tapo C520WS v2 device's API authorization mechanism allows restricted account users to execute unauthorized sensitive operations. The vulnerability, with a CVSS score of 7 and HIGH severity, enables attackers to bypass whitelist restrictions by crafting requests that leverage legitimate 'method mapping' behavior, potentially leading to device resets, unintended configuration changes, o [truncated]
A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2. The vulnerability is caused by improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter a non-responsive state. Successful exploitation may cause the RTSP to be in a denial-of-service condition.
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of TP-Link TL-SG108PE v5 switches. The vulnerability stems from improper sanitization of the SYSNAM configuration parameter during configuration file import operations. An attacker with administrative privileges can inject malicious JavaScript into device configuration files, which becomes stored and executes in an ad [truncated]
TP-Link Tapo smart home devices transmit Bluetooth pairing data in cleartext during initial setup, enabling proximity-based attackers to sniff or manipulate device initialization traffic. The vulnerability affects Tapo L535E (v1.0/v3.0) smart bulbs, Tapo P300 (v1.0) smart plugs, and Tapo D100C (v1.0) doorbell chimes. Bluetooth is only active during device initialization, limiting the attack window to the [truncated]
A high-severity authentication bypass vulnerability exists in the Archer C64 v1 router, where a debug SSH service fails to enforce rate-limiting on authentication attempts. The SSH service shares credentials with the web interface, enabling brute-force attacks against administrative accounts. An attacker with adjacent network access can exploit this weakness to obtain valid credentials through unlimited a [truncated]
An authenticated command injection vulnerability in TP-Link Archer BE450 v1 and BE7200 v1 routers allows administrators to execute arbitrary system commands through the web management interface. The vulnerability stems from insufficient input sanitization when crafted input is passed to backend system commands. Successful exploitation grants elevated privileges, enabling unauthorized service startup, syst [truncated]
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation grants full administrative control of the affected device, with potential impacts to confidentiality, integrity, and availability. The vulnerability ca [truncated]
CVE-2026-5511 describes a limited information-disclosure issue in the web management interface of Archer AX72 (SG) v1. When invalid input is handled by the network diagnostic feature, an authenticated administrator can confirm that the diagnostic utility exists and view its command-line syntax and options. The published description states that the exposure is narrow and does not reveal sensitive system data.
CVE-2026-5039 is a high-severity vulnerability in TP-Link TL-WR841N v13, which uses DES-CBC encryption in the TDDPv2 debug protocol with a predictable cryptographic key derived from default web management credentials. If the device is left in its default configuration, a network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device [truncated]
CVE-2026-0834 is a high-severity logic vulnerability affecting TP-Link Archer C20, Archer AX53, and TL-WR841N v13 devices. The vulnerability allows unauthenticated adjacent attackers to execute administrative commands, including factory resets and reboots, without credentials. This can lead to configuration loss and device availability interruptions. The vulnerability is patched in various firmware versio [truncated]
CVE-2026-5363 is a medium-severity weakness in TP-Link Archer C7 firmware where the web interface uses client-side RSA-1024 encryption for administrator login. According to the supplied record, an adjacent attacker who can intercept network traffic could attempt brute-force or factorization attacks against the 1024-bit RSA key and recover the plaintext admin password, which could lead to unauthorized devi [truncated]
The CVE-2025-15608 vulnerability affects TP-Link AX53 v1, AX55 v4, and AX55 v4.6 devices due to insufficient input sanitization in probe handling logic, potentially leading to stack-based buffer overflows and, under specific conditions, remote code execution. This vulnerability has a CVSS score of 7.7, indicating high severity. Network administrators and security teams should prioritize patching and monit [truncated]
CVE-2026-0629 is a high-severity authentication bypass in the password recovery feature of TP-Link VIGI cameras’ local web interface. According to the CISA CSAF advisory, an attacker on the LAN can manipulate client-side state to reset the admin password without verification and then obtain full administrative access. TP-Link and CISA list firmware updates as the primary remediation, and the advisory was [truncated]
CVE-2026-22226 is a high-severity command injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an authenticated admin to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer [truncated]
An OS Command Injection vulnerability exists in TP-Link Archer BE230 v1.2 and OpenVPN of AXE75 v1. This allows an adjacent authenticated attacker to execute arbitrary code, potentially gaining full administrative control of the device. The vulnerability affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer AXE75 v1 < 1.5.6 Build 20260623. Network administrators and security teams should be [truncated]
