CVE-2025-7851
criticalAn attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
Vendor / product: Tp-link — fr307-m2 firmware
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-10-21 01:15
Modified: 2026-10-18 21:10
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
tp-link / fr307-m2_firmware <1.2.5, 1.2.5
tp-link / fr205_firmware <1.0.3, 1.0.3
tp-link / fr365_firmware <1.1.10, 1.1.10
tp-link / g611_firmware <1.2.2, 1.2.2
tp-link / g36_firmware <1.1.4, 1.1.4
tp-link / er7212pc_firmware <2.1.3, 2.1.3
tp-link / er706w-4g_firmware <1.2.1, 1.2.1
tp-link / er706w_firmware <1.2.1, 1.2.1
tp-link / er605_firmware <2.3.1, 2.3.1
tp-link / er7206_firmware <2.2.2, 2.2.2
tp-link / er707-m2_firmware <1.3.1, 1.3.1
tp-link / er7412-m2_firmware <1.1.0, 1.1.0
tp-link / er8411_firmware <1.3.3, 1.3.3
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://support.omadanetworks.com/en/document/108456/
References
- https://support.omadanetworks.com/en/document/108456/ f23511db-6c3e-4e32-a477-6aa17d310630
- https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-rout... f23511db-6c3e-4e32-a477-6aa17d310630
- https://www.omadanetworks.com/us/business-networking/all-omada-router/ f23511db-6c3e-4e32-a477-6aa17d310630
- https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ f23511db-6c3e-4e32-a477-6aa17d310630
- https://www.tp-link.com/us/business-networking/soho-festa-gateway/ f23511db-6c3e-4e32-a477-6aa17d310630
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗