CVE-2026-19586

critical

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient va…

Vendor / product: Tp-link — er7212pc firmware

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-08-20 19:16

Modified: 2026-10-26 10:10

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

tp-link / er7212pc_firmware <2.4.3

tp-link / er605_firmware <2.4.4

tp-link / er605w_firmware <2.0.4

tp-link / er7206_firmware <2.3.5

tp-link / er7406_firmware <1.3.4

tp-link / er707-m2_firmware <1.4.4

tp-link / er7412-m2_firmware <1.2.0

tp-link / er8411_firmware <1.4.1

tp-link / er706w_firmware <1.2.11

tp-link / er706w-4g_firmware <1.2.6, <2.1.11

tp-link / er706wp-4g_firmware <1.1.11

tp-link / er703wp-4g-outdoor_firmware <1.1.7

tp-link / er603wp-4g-outdoor_firmware <1.0.2

tp-link / er701-5g-outdoor_firmware <1.0.3

tp-link / dr3220v-4g_firmware <1.2.0

tp-link / dr3650v_firmware <1.2.0

tp-link / dr3650v-4g_firmware <1.2.0

tp-link / dr3150_firmware <1.0.1

Weakness classification (CWE)

CWE-78

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://www.tp-link.com/us/support/faq/5256/

References

https://mattg.systems/posts/cve-2026-19586/ f23511db-6c3e-4e32-a477-6aa17d310630
https://www.omadanetworks.com/en/support/download/ f23511db-6c3e-4e32-a477-6aa17d310630
https://www.omadanetworks.com/us/support/download/ f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/faq/5256/ f23511db-6c3e-4e32-a477-6aa17d310630

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-19586

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs