Critical · published October 21, 2025
🚨 A remote attacker can execute arbitrary operating system commands without any authentication—it's like handing over the keys to your server without a password! 🔥 This vulnerability is like a construction worker who can stroll into a building site without showing a badge—anyone can just walk in and start making changes without anyone noticing. 🤦♂️ The consequences are absolutely devastating; an attacker could control your server, steal sensitive data, or sabotage your systems entirely. It's an open invitation for chaos, with the potential for complete system compromise.
This vulnerability is like a construction worker who can stroll into a building site without showing a badge—anyone can just walk in and start making changes without anyone noticing. 🤦♂️ This vulnerability allows an unauthenticated remote attacker to execute commands on the host operating system, leveraging a flaw in input validation that fails to sanitize user inputs properly.
The consequences are absolutely devastating; an attacker could control your server, steal sensitive data, or sabotage your systems entirely. It's an open invitation for chaos, with the potential for complete system compromise. Patch your system immediately to the latest version and implement strict access controls to limit incoming traffic. Conduct a thorough security audit to ensure no vulnerabilities linger elsewhere! You've got this! Follow these steps to secure your systems and regain control! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tp-link/er8411_firmware | < 1.3.3 | 1.3.3 |
| tp-link/er8411_firmware | all versions | — |
| tp-link/er7412-m2_firmware | < 1.1.0 | 1.1.0 |
| tp-link/er7412-m2_firmware | all versions | — |
| tp-link/er707-m2_firmware | < 1.3.1 | 1.3.1 |
| tp-link/er707-m2_firmware | all versions | — |
| tp-link/er7206_firmware | < 2.2.2 | 2.2.2 |
| tp-link/er7206_firmware | all versions | — |
| tp-link/er605_firmware | < 2.3.1 | 2.3.1 |
| tp-link/er605_firmware | all versions | — |
| tp-link/er706w_firmware | < 1.2.1 | 1.2.1 |
| tp-link/er706w_firmware | all versions | — |
| tp-link/er706w-4g_firmware | < 1.2.1 | 1.2.1 |
| tp-link/er706w-4g_firmware | all versions | — |
| tp-link/er7212pc_firmware | < 2.1.3 | 2.1.3 |
| tp-link/er7212pc_firmware | all versions | — |
| tp-link/g36_firmware | < 1.1.4 | 1.1.4 |
| tp-link/g36_firmware | all versions | — |
| tp-link/g611_firmware | < 1.2.2 | 1.2.2 |
| tp-link/g611_firmware | all versions | — |
| tp-link/fr365_firmware | < 1.1.10 | 1.1.10 |
| tp-link/fr365_firmware | all versions | — |
| tp-link/fr205_firmware | < 1.0.3 | 1.0.3 |
| tp-link/fr205_firmware | all versions | — |
| tp-link/fr307-m2_firmware | < 1.2.5 | 1.2.5 |
| tp-link/fr307-m2_firmware | all versions | — |