TP-Link urges immediate updates for Omada Gateways after critical flaws discovery

TP-Link has issued urgent guidance after uncovering critical flaws in Omada gateways across ER, G and FR models, with the company stating that firmware updates should be installed immediately to stay secure.

According to TP-Link, the most severe issue is CVE-2025-6542, a high-severity arbitrary OS command vulnerability that can be exploited by a user logged into the web management interface or by a remote unauthenticated attacker, potentially allowing commands to be executed on the device’s underlying operating system. A second critical vulnerability, CVE-2025-7850, also with a CVSS of 9.3, concerns command injection that could be exploited after admin authentication on the web portal.

The vendor notes two additional flaws, CVE-2025-7851 and CVE-2025-6541, both rated highly, involving root access and further arbitrary command execution respectively. TP-Link urges all users to install the latest firmware from its support site, to change default or weak passwords, and to restrict management-interface access to trusted internal networks.