Critical severity9.8NVD Advisory· Published Oct 21, 2025· Updated Jun 17, 2026
CVE-2025-7851
CVE-2025-7851
Description
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
30cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*range: <2.3.1
- cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*range: <1.2.1
- cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*range: <1.2.1
- cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*range: <1.3.1
- cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*range: <2.2.2
- cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*range: <2.1.3
- cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*range: <1.1.0
- cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*range: <1.3.3
- cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*range: <1.0.3
- cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*range: <1.2.5
- cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*range: <1.1.10
- cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*range: <1.1.4
- cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*
cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*range: <1.2.2
- cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*
- TP-Link Systems Inc./Festa gatewaysv5Range: 0
0+ 1 more
- (no CPE)range: 0
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
5- support.omadanetworks.com/en/document/108456/nvdVendor Advisory
- www.omadanetworks.com/us/business-networking/all-omada-router/nvdProduct
- www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/nvdProduct
- www.tp-link.com/us/business-networking/soho-festa-gateway/nvdProduct
- www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/nvd
News mentions
4- ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More StoriesThe Hacker News · Aug 6, 2026
- 15 TP-Link Omada ZTP Flaws Enable Router Hijacking and Root Code ExecutionCyber Security News · Aug 5, 2026
- TP-Link patches Omada ZTP flaws allowing hackers to breach networksBleepingComputer · Aug 4, 2026
- TP-Link Omada ZTP Vulnerabilities Chain Into Full Network TakeoverSecurityWeek · Aug 4, 2026