en
TP-Link is a global networking and consumer electronics company offering home, small business, and enterprise networking devices and services. The Omada line provides cloud-managed networking for businesses, while consumer products cover home routers and related electronics. The company operates worldwide with multiple regional offices and a broad product portfolio.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2018-25321Cross-site request forgery in TP-Link TL-WR720N enables unauthorized router administrationCVE-2025-40634Root-running buffer overflow enables code execution in TP-Link Archer AX50CVE-2025-3442Information Disclosure Vulnerability in TP-Link Tapo IoT Smart HubCVE-2025-1099Hard-coded RSA Private Key Enables Impersonation Against TP-Link Tapo C500 Wi-Fi CameraCVE-2025-0730TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2018-25321Cross-site request forgery in TP-Link TL-WR720N enables unauthorized router administration | Exploitation statusActively exploited | FixNo |
| Affected productTL-WR720NMbps Wireless N Router |
| Published05/17/2026 |
| SeverityMedium |
CVE-2025-40634Root-running buffer overflow enables code execution in TP-Link Archer AX50 | Exploitation statusNot exploited | FixYes | Affected productLink Archer AX50 | Published05/20/2025 | SeverityCritical |
|---|
CVE-2025-3442Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub | Exploitation statusNot exploited | FixYes | Affected productTapo H200 V1 IoT Smart Hub | Published04/09/2025 | SeverityMedium |
|---|
CVE-2025-1099Hard-coded RSA Private Key Enables Impersonation Against TP-Link Tapo C500 Wi-Fi Camera | Exploitation statusNot exploited | FixYes | Affected productTapo C500 V1 Wi-Fi Camera | Published02/10/2025 | SeverityHigh |
|---|
CVE-2025-0730TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings | Exploitation statusActively exploited | FixYes | Affected productTL-SG108E | Published01/27/2025 | SeverityMedium |
|---|
CVE-2025-0729TP-Link TL-SG108E clickjacking | Exploitation statusNot exploited | FixYes | Affected productTL-SG108E | Published01/27/2025 | SeverityMedium |
|---|
CVE-2024-12344TP-Link VN020 F3v(T) FTP USER Command memory corruption | Exploitation statusActively exploited | FixNo | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityMedium |
|---|
CVE-2024-12343TP-Link VN020 F3v(T) SOAP Request WANIPConnection buffer overflow | Exploitation statusActively exploited | FixNo | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityHigh |
|---|
CVE-2024-12342TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service | Exploitation statusActively exploited | FixNo | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityHigh |
|---|
CVE-2024-54127Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50 | Exploitation statusNot exploited | FixYes | Affected productArcher C50 Wireless Router | Published12/05/2024 | SeverityMedium |
|---|
CVE-2024-54126Insufficient Integrity Verification Vulnerability in TP-Link Archer C50 | Exploitation statusNot exploited | FixYes | Affected productArcher C50 Wireless Router | Published12/05/2024 | SeverityHigh |
|---|
CVE-2024-11237TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productVN020 F3v(T) | Published11/15/2024 | SeverityHigh |
|---|
CVE-2024-10523Information Disclosure Vulnerability in TP-Link IoT Smart Hub | Exploitation statusNot exploited | FixYes | Affected productTP-Link Tapo H100 IoT Smart Hub | Published11/04/2024 | SeverityMedium |
|---|
CVE-2024-9284TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productTL-WR841ND | Published09/27/2024 | SeverityHigh |
|---|
CVE-2024-4224Authenticated stored XSS in TP-Link TL-SG1016DE enables JavaScript execution in an administrator's browser | Exploitation statusActively exploited | FixYes | Affected productTL-SG1016DE | Published07/15/2024 | SeverityMedium |
|---|
CVE-2024-38471Authenticated backup restore OS command injection in TP-LINK Archer routers | Exploitation statusNot exploited | FixNo | Affected productArcher Air R5 | Published07/04/2024 | SeverityMedium |
|---|
CVE-2024-21827CVE-2024-21827 | Exploitation statusActively exploited | FixNo | Affected productER7206 Omada Gigabit VPN Router | Published06/25/2024 | SeverityHigh |
|---|
CVE-2024-5035TP-Link Archer C5400X - RFTest Unauthenticated Command Injection | Exploitation statusNot exploited | FixYes | Affected productArcher C4500X | Published05/27/2024 | SeverityHigh |
|---|
CVE-2024-5244TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published05/23/2024 | SeverityMedium |
|---|
CVE-2024-5243TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
|---|
CVE-2024-5242TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
|---|
CVE-2024-5228TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
|---|
CVE-2024-5227TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
|---|
CVE-2024-31340CVE-2024-31340 | Exploitation statusNot exploited | FixNo | Affected productTP-Link Tapo | Published05/22/2024 | SeverityMedium |
|---|
CVE-2023-50225TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTL-WR902AC | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-50224TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability | Exploitation statusKEV | FixNo | Affected productArcher C5 | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-44448TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productArcher A54 | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-44447TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTL-WR902AC | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-41184TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTapo C210 | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-39471Unauthenticated ated_tp Command Injection in TP-Link TL-WR841N Enables Root Code Execution | Exploitation statusNot exploited | FixNo | Affected productTL-WR841N | Published05/03/2024 | SeverityHigh |
|---|
CVE-2023-35717TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTapo C210 | Published05/03/2024 | SeverityHigh |
|---|
CVE-2023-27359TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability | Exploitation statusNot exploited | FixNo | Affected productAX1800 | Published05/03/2024 | SeverityCritical |
|---|
CVE-2023-27346TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productAX1800 | Published05/03/2024 | SeverityHigh |
|---|
CVE-2023-27333TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productArcher AX21 | Published05/03/2024 | SeverityMedium |
|---|
CVE-2023-27332TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productArcher AX21 | Published05/03/2024 | SeverityHigh |
|---|
CVE-2023-49913CVE-2023-49913 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49912CVE-2023-49912 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49911CVE-2023-49911 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49910CVE-2023-49910 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49909CVE-2023-49909 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49908CVE-2023-49908 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49907CVE-2023-49907 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49906CVE-2023-49906 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49134CVE-2023-49134 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49133CVE-2023-49133 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-49074CVE-2023-49074 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2023-48724CVE-2023-48724 | Exploitation statusNot exploited | FixNo | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
|---|
CVE-2024-1180TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published04/03/2024 | SeverityMedium |
|---|
CVE-2024-1179TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productOmada ER605 | Published04/01/2024 | SeverityHigh |
|---|
CVE-2023-6437OS Command Injection in TP-Link Routers | Exploitation statusNot exploited | FixYes | Affected productTP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u | Published03/28/2024 | SeverityCritical |
|---|
116 Results | Page 1 of 3