Critical TP-Link Omada Gateway Flaw (CVE-2025-6542, CVSS 9.3) Allows Unauthenticated Remote Command Execution

TP-Link has issued a firmware update to address four high- and critical-severity vulnerabilities in its Omada gateway line, including CVE-2025-6542 (CVSS 9.3) which enables remote unauthenticated attackers to execute arbitrary OS commands. According to TP-Link’s advisory, an arbitrary OS command may be executed on Omada gateways by a user who can log in to the web management interface or by a remote unauthenticated attacker.

The two most critical flaws are CVE-2025-6542 (CVSS 9.3) and CVE-2025-6541 (CVSS 8.6), the latter allowing authenticated users to run arbitrary commands via the web management interface, with both affecting multiple Omada gateway models. In addition, two related command injection issues—CVE-2025-7850 (CVSS 9.3) and CVE-2025-7851 (CVSS 8.7)—could allow authenticated users or credential-compromised attackers to gain root-level control.

TP-Link urges customers to install the latest firmware and to review configurations, change administrative passwords, restrict management interface access to trusted networks, and implement network segmentation where possible. The advisory notes that attackers may execute arbitrary commands on the device’s underlying operating system, potentially enabling complete system compromise if left unpatched.