Evil-DB LogoEvil-DB
← All CVEs

CVE-2026-19586

critical · 9.3

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.  Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

9.3
CVSS
5.7%
EPSS (exploit prob.)
93rd
EPSS percentile
2026-08-20
Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
tp-linker7212pc_firmware< 2.4.3
tp-linker7212pc2.0
tp-linker605_firmware< 2.4.4
tp-linker6052.0
tp-linker605w_firmware< 2.0.4
tp-linker605w2.0
tp-linker7206_firmware< 2.3.5
tp-linker72062.0
tp-linker7406_firmware< 1.3.4
tp-linker7406all versions
tp-linker707-m2_firmware< 1.4.4
tp-linker707-m2all versions
tp-linker7412-m2_firmware< 1.2.0
tp-linker7412-m2all versions
tp-linker8411_firmware< 1.4.1
tp-linker8411all versions
tp-linker706w_firmware< 1.2.11
tp-linker706wall versions
tp-linker706w-4g_firmware< 1.2.6
tp-linker706w-4gall versions
tp-linker706w-4g_firmware< 2.1.11
tp-linker706w-4g2.0
tp-linker706wp-4g_firmware< 1.1.11
tp-linker706wp-4gall versions
tp-linker703wp-4g-outdoor_firmware< 1.1.7
tp-linker703wp-4g-outdoorall versions
tp-linker603wp-4g-outdoor_firmware< 1.0.2
tp-linker603wp-4g-outdoorall versions
tp-linker701-5g-outdoor_firmware< 1.0.3
tp-linker701-5g-outdoorall versions
tp-linkdr3220v-4g_firmware< 1.2.0
tp-linkdr3220v-4gall versions
tp-linkdr3650v_firmware< 1.2.0
tp-linkdr3650vall versions
tp-linkdr3650v-4g_firmware< 1.2.0
tp-linkdr3650v-4gall versions
tp-linkdr3150_firmware< 1.0.1
tp-linkdr3150all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-19586