# CVE-2025-7850: A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Source: https://junglewise.ai/threats/cve-2025-7850-a-command-injection-vulnerability-may-be-exploited-after-the-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-21  
License: CC BY 4.0 with a link back

CVE-2025-7850 · Severity: high · CVSS 7.2 · Published 2025-10-21

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Technologies: [TP-Link Er605](https://junglewise.ai/threats/technologies/er605), [TP-Link Er605 Firmware](https://junglewise.ai/threats/technologies/er605-firmware), [TP-Link Er706w](https://junglewise.ai/threats/technologies/er706w), [TP-Link Er706w Firmware](https://junglewise.ai/threats/technologies/er706w-firmware), [TP-Link Er706w-4g](https://junglewise.ai/threats/technologies/er706w-4g), [TP-Link Er706w-4g Firmware](https://junglewise.ai/threats/technologies/er706w-4g-firmware), [TP-Link Er707-M2](https://junglewise.ai/threats/technologies/er707-m2), [TP-Link Er707-M2 Firmware](https://junglewise.ai/threats/technologies/er707-m2-firmware), [TP-Link Er7206](https://junglewise.ai/threats/technologies/er7206), [TP-Link Er7206 Firmware](https://junglewise.ai/threats/technologies/er7206-firmware), [TP-Link Er7212pc](https://junglewise.ai/threats/technologies/er7212pc), [TP-Link Er7212pc Firmware](https://junglewise.ai/threats/technologies/er7212pc-firmware), [TP-Link Er7412-M2](https://junglewise.ai/threats/technologies/er7412-m2), [TP-Link Er7412-M2 Firmware](https://junglewise.ai/threats/technologies/er7412-m2-firmware), [TP-Link Er8411](https://junglewise.ai/threats/technologies/er8411), [TP-Link Er8411 Firmware](https://junglewise.ai/threats/technologies/er8411-firmware), [TP-Link Fr205](https://junglewise.ai/threats/technologies/fr205), [TP-Link Fr205 Firmware](https://junglewise.ai/threats/technologies/fr205-firmware), [TP-Link Fr307-M2](https://junglewise.ai/threats/technologies/fr307-m2), [TP-Link Fr307-M2 Firmware](https://junglewise.ai/threats/technologies/fr307-m2-firmware), [TP-Link Fr365](https://junglewise.ai/threats/technologies/fr365), [TP-Link Fr365 Firmware](https://junglewise.ai/threats/technologies/fr365-firmware), [TP-Link G36](https://junglewise.ai/threats/technologies/g36), [TP-Link G36 Firmware](https://junglewise.ai/threats/technologies/g36-firmware), [TP-Link G611](https://junglewise.ai/threats/technologies/g611), [TP-Link G611 Firmware](https://junglewise.ai/threats/technologies/g611-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2025-7850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7850 being exploited in the wild.

**How severe is CVE-2025-7850?** High severity, with a CVSS score of 7.2, published 21 October 2025.

**Which products and versions are affected?** TP-Link Er605, TP-Link Er605 Firmware, TP-Link Er706w, TP-Link Er706w Firmware and 22 more. The advisory does not name versions.

**Is there a fix for CVE-2025-7850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-7850?** Check whether you run TP-Link Er605, TP-Link Er605 Firmware, TP-Link Er706w or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- TP-Link Er605
- TP-Link Er605 Firmware
- TP-Link Er706w
- TP-Link Er706w Firmware
- TP-Link Er706w-4g
- TP-Link Er706w-4g Firmware
- TP-Link Er707-M2
- TP-Link Er707-M2 Firmware
- TP-Link Er7206
- TP-Link Er7206 Firmware
- TP-Link Er7212pc
- TP-Link Er7212pc Firmware
- TP-Link Er7412-M2
- TP-Link Er7412-M2 Firmware
- TP-Link Er8411
- TP-Link Er8411 Firmware
- TP-Link Fr205
- TP-Link Fr205 Firmware
- TP-Link Fr307-M2
- TP-Link Fr307-M2 Firmware
- TP-Link Fr365
- TP-Link Fr365 Firmware
- TP-Link G36
- TP-Link G36 Firmware
- TP-Link G611
- TP-Link G611 Firmware

## Related threats

- [An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.](https://junglewise.ai/threats/cve-2025-7851-an-attacker-may-obtain-the-root-shell-on-the-underlying-os-system)
- [An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.](https://junglewise.ai/threats/cve-2025-6542-an-arbitrary-os-command-may-be-executed-on-the-product-by-a-remote)
- [An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.](https://junglewise.ai/threats/cve-2025-6541-an-arbitrary-os-command-may-be-executed-on-the-product-by-the-user)