CVE-2025-6541: TP-Link ER605 Firmware

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Affected products

• TP-Link ER605 Firmware: before 2.3.1 (fixed in 2.3.1); version 2.3.1 only
• TP-Link ER706W-4g Firmware: before 1.2.1 (fixed in 1.2.1); version 1.2.1 only
• TP-Link ER706W Firmware: before 1.2.1 (fixed in 1.2.1); version 1.2.1 only
• TP-Link ER707-m2 Firmware: before 1.3.1 (fixed in 1.3.1); version 1.3.1 only
• TP-Link ER7206 Firmware: before 2.2.2 (fixed in 2.2.2); version 2.2.2 only
• TP-Link ER7212PC Firmware: before 2.1.3 (fixed in 2.1.3); version 2.1.3 only
• TP-Link ER7412-m2 Firmware: before 1.1.0 (fixed in 1.1.0); version 1.1.0 only
• TP-Link ER8411 Firmware: before 1.3.3 (fixed in 1.3.3); version 1.3.3 only
• TP-Link FR205 Firmware: before 1.0.3 (fixed in 1.0.3); version 1.0.3 only
• TP-Link FR307-m2 Firmware: before 1.2.5 (fixed in 1.2.5); version 1.2.5 only
• TP-Link FR365 Firmware: before 1.1.10 (fixed in 1.1.10); version 1.1.10 only
• TP-Link g36 Firmware: before 1.1.4 (fixed in 1.1.4); version 1.1.4 only
• TP-Link g611 Firmware: before 1.2.2 (fixed in 1.2.2); version 1.2.2 only

Published 2025-10-21. Last modified 2026-06-17.