TP-Link Omada EAP Devices Multiple Vulnerabilities Advisory (Pre-Auth OS Command Injection/Session Termination)

Vulnerability Overview Several security vulnerabilities exist in Omada Gateways, specifically: 1. CVE-2026-9033: Unauthorized captive portal session termination and forced logout. 2. CVE-2026-19586: Pre-authentication OS command injection. 3. CVE-2026-19683: Unauthorized transmission of DDNS credentials. Affected Scope CVE-2026-9033: CVSS v4.0 Score 6.0 / Medium - An unauthorized attacker can terminate active captive portal sessions, leading to service interruption and requiring users to re-authenticate. CVE-2026-19586: CVSS v4.0 Score 9.3 / Critical - An unauthorized attacker can execute arbitrary commands, potentially leading to full device compromise. CVE-2026-19683: CVSS v4.0 Score 6.1 / Medium - An unauthorized attacker can steal DDNS credentials, gaining access to DDNS management functions or modifying DNS records. Remediation Affected Products/Versions and Fix Firmware: - EAP120: Hardware Version M1, Firmware Version 2.4.3 Build 20260722 Rel.62250 - EAP605: Hardware Version V2, Firmware Version 2.4.4 Build 20260630 Rel.41598 - EAP206: Hardware Version V2, Firmware Version 2.5.5 Build 20260625 Rel.41536 - EAP108: Hardware Version M1, Firmware Version 3.4.4 Build 20260625 Rel.41536 - EAP102-M2: Hardware Version M1, Firmware Version 4.4.4 Build 20260625 Rel.41595 - EAP102-M2: Hardware Version M1, Firmware Version 3.2.0 Build 20260630 Rel.82947 - EAP611: Hardware Version M1, Firmware Version 4.1.0 Build 20260708 Rel.61832 - EAP706W: Hardware Version M1, Firmware Version 3.21.0 Build 20260723 Rel.41567 - EAP706W-4G: Hardware Version M1, Firmware Version 3.2.6 Build 20260723 Rel.41521 - EAP706W-4G: Hardware Version V2, Firmware Version 3.21.0 Build 20260723 Rel.61826 - EAP706WP-4G: Hardware Version M1, Firmware Version 31.0 Build 20260723 Rel.41624 - EAP205WP-4G-Outdoor: Hardware Version M1, Firmware Version 3.7.0 Build 20260725 Rel.41712 - EAP220-4G: Hardware Version M1, Firmware Version 3.2.0 Build 20260630 Rel.82956 - EAP650v: Hardware Version M1, Firmware Version 3.2.0 Build 20260630 Rel.83311 - EAP650v-4G: Hardware Version M1, Firmware Version 3.2.0 Build 20260630 Rel.83547 - EAP606WP-4G-Outdoor: Hardware Version M1, Firmware Version 3.2.0 Build 20260723 Rel.43277 - EAP150: Hardware Version M1, Firmware Version 0.1 Build 20260722 Rel.16854 - EAP101-5G-Outdoor: Hardware Version M1, Firmware Version 0.3.3 Build 20260723 Rel.40087 - EAP205W: Hardware Version V2, Firmware Version 3.2.0 Build 20260723 Rel.43765 Recommended Measures: - Users are strongly advised to upgrade affected devices to the latest firmware version to patch the vulnerabilities. - If an immediate firmware upgrade is not possible, users should disable the OpenVPN server functionality until the remedial firmware can be applied. Additional Information Disclaimer: This announcement is for reference only. TP-Link is not liable for any damages or losses resulting from the implementation of these updates. --- Summary Several critical security vulnerabilities exist in Omada Gateways, including unauthorized session termination, command injection, and credential transmission. Affected products require an upgrade to specific firmware versions to resolve these issues. Users are advised to take remedial actions as soon as possible to ensure device security.

Goal Reached Thanks to every supporter — we hit 100%!

TP-Link Omada EAP Devices Multiple Vulnerabilities Advisory (Pre-Auth OS Command Injection/Session Termination)