en
Severity across 95 analyzed records
A short verification protects source data and prevents automated AI requests.
The GCVE catalog currently lists 143 vulnerability records associated with TP-Link.
Among the 95 records analyzed by CyStack, 59 are High or Critical and 2 appear in the CISA KEV catalog for priority remediation.
The list below is based on vulnerabilities that have been viewed and analyzed; it does not represent the complete global vulnerability corpus. Use the product filter to narrow the scope.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-15544Weak Credential Protection During TP-Link Omada Device Adoption | Exploitation statusNot known exploited | FixYes | Affected productOmada gateways | Published08/03/2026 | SeverityMedium |
CVE-2018-25321TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719) | Exploitation statusPublic exploit | FixNot confirmed | Affected productTL-WR720NMbps Wireless N Router | Published05/17/2026 | SeverityMedium |
CVE-2025-9293Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception | Exploitation statusNot known exploited | FixYes | Affected productTapo App | Published02/13/2026 | SeverityHigh |
CVE-2025-9292Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers | Exploitation statusNot known exploited | FixYes | Affected productOmada Cloud Controller | Published02/13/2026 | SeverityLow |
CVE-2025-9522Blind Server-Side Request Forgery (SSRF) in Omada Controller | Exploitation statusNot known exploited | FixYes | Affected productOmada Controller | Published01/26/2026 | SeverityMedium |
CVE-2025-9521Password Confirmation Bypass in Omada Controller | Exploitation statusNot known exploited | FixYes | Affected productOmada Controller | Published01/26/2026 | SeverityLow |
CVE-2025-9520IDOR Leading to Owner Account Hijacking in Omada Controller | Exploitation statusNot known exploited | FixYes | Affected productOmada Controller | Published01/26/2026 | SeverityHigh |
CVE-2025-40634Stack-based buffer overflow in TP-Link Archer AX50 | Exploitation statusNot known exploited | FixYes | Affected productLink Archer AX50 | Published05/20/2025 | SeverityCritical |
CVE-2025-3442Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub | Exploitation statusNot known exploited | FixYes | Affected productTapo H200 V1 IoT Smart Hub | Published04/09/2025 | SeverityMedium |
CVE-2025-1099Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera | Exploitation statusNot known exploited | FixYes | Affected productTapo C500 V1 Wi-Fi Camera | Published02/10/2025 | SeverityHigh |
CVE-2025-0730TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings | Exploitation statusPublic exploit | FixYes | Affected productTL-SG108E | Published01/27/2025 | SeverityMedium |
CVE-2025-0729TP-Link TL-SG108E clickjacking | Exploitation statusNot known exploited | FixYes | Affected productTL-SG108E | Published01/27/2025 | SeverityMedium |
CVE-2024-12344TP-Link VN020 F3v(T) FTP USER Command memory corruption | Exploitation statusPublic exploit | FixNot confirmed | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityMedium |
CVE-2024-12343TP-Link VN020 F3v(T) SOAP Request WANIPConnection buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityHigh |
CVE-2024-12342TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service | Exploitation statusPublic exploit | FixNot confirmed | Affected productVN020 F3v(T) | Published12/08/2024 | SeverityHigh |
CVE-2024-54127Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50 | Exploitation statusNot known exploited | FixYes | Affected productArcher C50 Wireless Router | Published12/05/2024 | SeverityMedium |
CVE-2024-54126Insufficient Integrity Verification Vulnerability in TP-Link Archer C50 | Exploitation statusNot known exploited | FixYes | Affected productArcher C50 Wireless Router | Published12/05/2024 | SeverityHigh |
CVE-2024-11237TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productVN020 F3v(T) | Published11/15/2024 | SeverityHigh |
CVE-2024-10523Information Disclosure Vulnerability in TP-Link IoT Smart Hub | Exploitation statusNot known exploited | FixYes | Affected productTP-Link Tapo H100 IoT Smart Hub | Published11/04/2024 | SeverityMedium |
CVE-2024-9284TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productTL-WR841ND | Published09/27/2024 | SeverityHigh |
CVE-2024-4224TP-Link TL-SG1016DE XSS | Exploitation statusPublic exploit | FixYes | Affected productTL-SG1016DE | Published07/15/2024 | SeverityMedium |
CVE-2024-38471CVE-2024-38471 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX3000 | Published07/04/2024 | SeverityMedium |
CVE-2024-21827CVE-2024-21827 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published06/25/2024 | SeverityHigh |
CVE-2024-5035TP-Link Archer C5400X - RFTest Unauthenticated Command Injection | Exploitation statusNot known exploited | FixYes | Affected productArcher C4500X | Published05/27/2024 | SeverityHigh |
CVE-2024-5244TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published05/23/2024 | SeverityMedium |
CVE-2024-5243TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
CVE-2024-5242TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
CVE-2024-5228TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
CVE-2024-5227TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published05/23/2024 | SeverityHigh |
CVE-2024-31340CVE-2024-31340 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTP-Link Tether | Published05/22/2024 | SeverityMedium |
CVE-2023-50225TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR902AC | Published05/03/2024 | SeverityMedium |
CVE-2023-44448TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher A54 | Published05/03/2024 | SeverityMedium |
CVE-2023-44447TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR902AC | Published05/03/2024 | SeverityMedium |
CVE-2023-41184TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTapo C210 | Published05/03/2024 | SeverityMedium |
CVE-2023-39471TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR841N | Published05/03/2024 | SeverityHigh |
CVE-2023-35717TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productTapo C210 | Published05/03/2024 | SeverityHigh |
CVE-2023-27359TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productAX1800 | Published05/03/2024 | SeverityCritical |
CVE-2023-27346TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productAX1800 | Published05/03/2024 | SeverityHigh |
CVE-2023-27333TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX21 | Published05/03/2024 | SeverityMedium |
CVE-2023-27332TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX21 | Published05/03/2024 | SeverityHigh |
CVE-2023-49074CVE-2023-49074 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49134CVE-2023-49134 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49133CVE-2023-49133 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-48724CVE-2023-48724 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49913CVE-2023-49913 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49912CVE-2023-49912 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49911CVE-2023-49911 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49910CVE-2023-49910 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49909CVE-2023-49909 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49908CVE-2023-49908 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49907CVE-2023-49907 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2023-49906CVE-2023-49906 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | Published04/09/2024 | SeverityHigh |
CVE-2024-1180TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published04/03/2024 | SeverityMedium |
CVE-2024-1179TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOmada ER605 | Published04/01/2024 | SeverityHigh |
CVE-2023-6437Authenticated RCE | Exploitation statusNot known exploited | FixYes | Affected productTP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u | Published03/28/2024 | SeverityCritical |
CVE-2024-2188Cross-Site Scripting vulnerability in TP-Link Archer AX50 | Exploitation statusNot known exploited | FixYes | Affected productArcher AX50 | Published03/05/2024 | SeverityMedium |
CVE-2023-43482CVE-2023-43482 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-36498CVE-2023-36498 | Exploitation statusNot known exploited | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-47209CVE-2023-47209 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-47167CVE-2023-47167 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-42664CVE-2023-42664 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-46683CVE-2023-46683 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-47617CVE-2023-47617 | Exploitation statusNot known exploited | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2023-47618CVE-2023-47618 | Exploitation statusPublic exploit | FixNot confirmed | Affected productER7206 Omada Gigabit VPN Router | Published02/06/2024 | SeverityHigh |
CVE-2024-21833CVE-2024-21833 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX3000 | Published01/10/2024 | SeverityHigh |
CVE-2024-21821CVE-2024-21821 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX3000 | Published01/10/2024 | SeverityHigh |
CVE-2024-21773CVE-2024-21773 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX3000 | Published01/10/2024 | SeverityHigh |
CVE-2023-34829CVE-2023-34829 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/28/2023 | SeverityMedium |
CVE-2023-38907CVE-2023-38907 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/25/2023 | SeverityUnknown |
CVE-2023-36489CVE-2023-36489 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR802N | Published09/06/2023 | SeverityUnknown |
CVE-2023-31188CVE-2023-31188 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C50 | Published09/06/2023 | SeverityHigh |
CVE-2023-32619CVE-2023-32619 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C50 | Published09/06/2023 | SeverityHigh |
CVE-2023-37284CVE-2023-37284 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C20 | Published09/06/2023 | SeverityUnknown |
CVE-2023-38563CVE-2023-38563 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C1200 | Published09/06/2023 | SeverityUnknown |
CVE-2023-38568CVE-2023-38568 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher A10 | Published09/06/2023 | SeverityUnknown |
CVE-2023-38588CVE-2023-38588 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C3150 | Published09/06/2023 | SeverityHigh |
CVE-2023-39224CVE-2023-39224 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C5 | Published09/06/2023 | SeverityUnknown |
CVE-2023-39935CVE-2023-39935 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C5400 | Published09/06/2023 | SeverityUnknown |
CVE-2023-40193CVE-2023-40193 | Exploitation statusNot known exploited | FixNot confirmed | Affected productDeco M4 | Published09/06/2023 | SeverityUnknown |
CVE-2023-40357CVE-2023-40357 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX50 | Published09/06/2023 | SeverityHigh |
CVE-2023-40531CVE-2023-40531 | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher AX6000 | Published09/06/2023 | SeverityUnknown |
CVE-2023-2646TP-Link Archer C7v2 GET Request Parameter denial of service | Exploitation statusNot known exploited | FixNot confirmed | Affected productArcher C7v2 | Published05/11/2023 | SeverityMedium |
CVE-2022-43636CVE-2022-43636 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR940N | Published03/29/2023 | SeverityHigh |
CVE-2022-43635CVE-2022-43635 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR940N | Published03/29/2023 | SeverityMedium |
CVE-2022-42433CVE-2022-42433 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR841N | Published03/29/2023 | SeverityMedium |
CVE-2022-24352CVE-2022-24352 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1750 | Published03/28/2023 | SeverityHigh |
CVE-2022-0650CVE-2022-0650 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR940N | Published03/28/2023 | SeverityMedium |
CVE-2022-24972CVE-2022-24972 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR940N | Published03/28/2023 | SeverityMedium |
CVE-2022-24353CVE-2022-24353 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAC1750 | Published03/28/2023 | SeverityHigh |
CVE-2022-24973CVE-2022-24973 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTL-WR940N | Published03/28/2023 | SeverityMedium |
CVE-2023-0936TP-Link Archer C50 Web Management Interface denial of service | Exploitation statusPublic exploit | FixNot confirmed | Affected productArcher C50 | Published02/21/2023 | SeverityMedium |
CVE-2023-22303CVE-2023-22303 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTP-Link SG105PE | Published01/17/2023 | SeverityCritical |
CVE-2022-4498A vulnerable HTTP Basic Authentication process in TP-Link routers, Archer C5 and WR710N-V1, is susceptible to either a DoS or an arbitrary code execution via any interface. | Exploitation statusNot known exploited | FixNot confirmed | Affected productWR710N | Published01/11/2023 | SeverityCritical |
CVE-2022-4499The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack. | Exploitation statusNot known exploited | FixNot confirmed | Affected productWR710N | Published01/11/2023 | SeverityHigh |
CVE-2022-41783CVE-2022-41783 | Exploitation statusNot known exploited | FixNot confirmed | Affected productTP-Link RE300 V1 | Published12/07/2022 | SeverityMedium |
CVE-2022-4296TP-Link TL-WR740N ARP resource consumption | Exploitation statusPublic exploit | FixNot confirmed | Affected productTL-WR740N | Published12/06/2022 | SeverityMedium |
CVE-2021-4045TP-LINK Tapo C200 remote code execution vulnerability | Exploitation statusNot confirmed | FixYes | Affected productTapo C200 | Published03/07/2022 | SeverityCritical |
CVE-2021-44032CVE-2021-44032 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/07/2022 | SeverityUnknown |
CVE-2022-24355CVE-2022-24355 | Exploitation statusNot confirmed | FixNot confirmed | Affected productTL-WR940N | Published02/18/2022 | SeverityHigh |
CVE-2022-24354CVE-2022-24354 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAC1750 | Published02/18/2022 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}