TP-Link g36 Firmware vulnerabilities

4 CVEs affecting TP-Link g36 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-7851, published 2025-10-21.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-7850, published 2025-10-21. High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
• CVE-2025-6542, published 2025-10-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
• CVE-2025-6541, published 2025-10-21. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
• CVE-2025-7851, published 2025-10-21. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.