Executive brief
TP-Link Omada gateways are enterprise-class networking devices that often serve as secure VPN endpoints for remote access to business networks. This vulnerability allows an unauthenticated attacker on the internet to execute arbitrary commands as the root user on any affected gateway with the OpenVPN SSL VPN feature enabled, potentially compromising all network traffic and connected systems.
Technical details
The vulnerability is a pre-authentication OS command injection (CWE-78) in the OpenVPN SSL VPN authentication handler (/usr/sbin/checkpsw.sh). The username submitted during OpenVPN connection establishment is unsafely spliced unquoted into an awk program before password validation occurs, allowing an attacker to inject arbitrary awk commands. An unauthenticated remote attacker can initiate an OpenVPN connection with a malicious username to achieve root-level code execution. The attack requires only network reachability to the VPN service (UDP 1194 by default) with no client certificate, valid credentials, or prior device access needed. TP-Link has released fixed firmware for affected Omada gateway models; until patched, disabling the OpenVPN Server feature or restricting WAN access to the VPN port mitigates the risk.
Affected products
- TP-Link Omada ER7212PC V2 firmware prior to 2.4.3 Build 20260722 Rel.40250
- TP-Link Omada ER605 V2 firmware prior to 2.4.4 Build 20260630 Rel.14398
- TP-Link Omada ER605W V2 firmware prior to 2.0.4 Build 20260723 Rel.43763
- TP-Link Omada ER7206 V2 firmware prior to 2.3.5 Build 20260625 Rel.43136
- TP-Link Omada ER7406 V1 firmware prior to 1.3.4 Build 20260625 Rel.43136
- TP-Link Omada ER707-M2 V1 firmware prior to 1.4.4 Build 20260625 Rel.43063
- TP-Link Omada ER7412-M2 V1 firmware prior to 1.2.0 Build 20260630 Rel.82947
- TP-Link Omada ER8411 V1 firmware prior to 1.4.1 Build 20260708 Rel.64832
- TP-Link Omada ER706W V1 firmware prior to 1.2.11 Build 20260723 Rel.41567
- TP-Link Omada ER706W-4G V1 firmware prior to 1.2.6 Build 20260723 Rel.41321; V2 firmware prior to 2.1.11 Build 20260723 Rel.41624
- TP-Link Omada ER706WP-4G V1 firmware prior to 1.1.11 Build 20260723 Rel.41624
- TP-Link Omada ER703WP-4G-Outdoor V1 firmware prior to 1.1.7 Build 20260723 Rel.41712
- TP-Link Omada ER603WP-4G-Outdoor V1 firmware prior to 1.0.2 Build 20260723 Rel.43271
- TP-Link Omada ER701-5G-Outdoor V1 firmware prior to 1.0.3 Build 20260723 Rel.40931
- TP-Link Omada DR3220v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.82652
- TP-Link Omada DR3650v V1 firmware prior to 1.2.0 Build 20260630 Rel.83311
- TP-Link Omada DR3650v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.83347
- TP-Link Omada DR3150 V1 firmware prior to 1.0.1 Build 20260722 Rel.16854
Timeline
- 2026-08-20: disclosed
- 2026-08-21: other: Technical analysis published by mattg.systems