CVE-2025-7850: TP-Link ER605 Firmware

High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days.

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Affected products

• TP-Link ER605 Firmware: before 2.3.1 (fixed in 2.3.1); version 2.3.1 only
• TP-Link ER706W-4g Firmware: before 1.2.1 (fixed in 1.2.1); version 1.2.1 only
• TP-Link ER706W Firmware: before 1.2.1 (fixed in 1.2.1); version 1.2.1 only
• TP-Link ER707-m2 Firmware: before 1.3.1 (fixed in 1.3.1); version 1.3.1 only
• TP-Link ER7206 Firmware: before 2.2.2 (fixed in 2.2.2); version 2.2.2 only
• TP-Link ER7212PC Firmware: before 2.1.3 (fixed in 2.1.3); version 2.1.3 only
• TP-Link ER7412-m2 Firmware: before 1.1.0 (fixed in 1.1.0); version 1.1.0 only
• TP-Link ER8411 Firmware: before 1.3.3 (fixed in 1.3.3); version 1.3.3 only
• TP-Link FR205 Firmware: before 1.0.3 (fixed in 1.0.3); version 1.0.3 only
• TP-Link FR307-m2 Firmware: before 1.2.5 (fixed in 1.2.5); version 1.2.5 only
• TP-Link FR365 Firmware: before 1.1.10 (fixed in 1.1.10); version 1.1.10 only
• TP-Link g36 Firmware: before 1.1.4 (fixed in 1.1.4); version 1.1.4 only
• TP-Link g611 Firmware: before 1.2.2 (fixed in 1.2.2); version 1.2.2 only

Published 2025-10-21. Last modified 2026-06-17.