CVE-2026-19586

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 20, 2026
Source updated: Aug 28, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

ER7212PC v2

Vendor: TP-Link Systems Inc.
Product: ER7212PC v2
Platforms: Unknown
Default status: unaffected

ER7212PC v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.4.3 Build 20260722 Rel.40250	Unavailable	None listed

ER605 v2

Vendor: TP-Link Systems Inc.
Product: ER605 v2
Platforms: Unknown
Default status: unaffected

ER605 v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.4.4 Build 20260630 Rel.14398	Unavailable	None listed

ER7206 v2

Vendor: TP-Link Systems Inc.
Product: ER7206 v2
Platforms: Unknown
Default status: unaffected

ER7206 v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.3.5 Build 20260625 Rel.43136	Unavailable	None listed

ER7406 v1

Vendor: TP-Link Systems Inc
Product: ER7406 v1
Platforms: Unknown
Default status: unaffected

ER7406 v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.3.4 Build 20260625 Rel.43136	Unavailable	None listed

ER707-M2 v1

Vendor: TP-Link Systems Inc.
Product: ER707-M2 v1
Platforms: Unknown
Default status: unaffected

ER707-M2 v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.4.4 Build 20260625 Rel.43063	Unavailable	None listed

ER7412-M2 v1

Vendor: TP-Link Systems Inc
Product: ER7412-M2 v1
Platforms: Unknown
Default status: unaffected

ER7412-M2 v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.0 Build 20260630 Rel.82947	Unavailable	None listed

ER8411 v1

Vendor: TP-Link Systems Inc.
Product: ER8411 v1
Platforms: Unknown
Default status: unaffected

ER8411 v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.4.1 Build 20260708 Rel.64832	Unavailable	None listed

ER706W v1

Vendor: TP-Link Systems Inc.
Product: ER706W v1
Platforms: Unknown
Default status: unaffected

ER706W v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.11 Build 20260723 Rel.41567	Unavailable	None listed

v1

Vendor: TP-Link Systems Inc.
Product: v1
Platforms: Unknown
Default status: unaffected

v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.6 Build 20260723 Rel.41321	Unavailable	None listed

ER706W-4G v2

Vendor: TP-Link Systems Inc.
Product: ER706W-4G v2
Platforms: Unknown
Default status: unaffected

ER706W-4G v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.1.11 Build 20260723 Rel.41624	Unavailable	None listed

ER706WP-4G v1

Vendor: TP-Link Systems Inc.
Product: ER706WP-4G v1
Platforms: Unknown
Default status: unaffected

ER706WP-4G v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.1.11 Build 20260723 Rel.41624	Unavailable	None listed

ER703WP-4G-Outdoor v1

Vendor: TP-Link Systems Inc.
Product: ER703WP-4G-Outdoor v1
Platforms: Unknown
Default status: unaffected

ER703WP-4G-Outdoor v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.1.7 Build 20260723 Rel.41712	Unavailable	None listed

DR3220v-4G v1

Vendor: TP-Link Systems Inc.
Product: DR3220v-4G v1
Platforms: Unknown
Default status: unaffected

DR3220v-4G v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.0 Build 20260630 Rel.82652	Unavailable	None listed

DR3650v v1

Vendor: TP-Link Systems Inc.
Product: DR3650v v1
Platforms: Unknown
Default status: unaffected

DR3650v v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.0 Build 20260630 Rel.83311	Unavailable	None listed

DR3650v-4G v1

Vendor: TP-Link Systems Inc.
Product: DR3650v-4G v1
Platforms: Unknown
Default status: unaffected

DR3650v-4G v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.2.0 Build 20260630 Rel.83347	Unavailable	None listed

ER603WP-4G-Outdoor v1

Vendor: TP-Link Systems Inc.
Product: ER603WP-4G-Outdoor v1
Platforms: Unknown
Default status: unaffected

ER603WP-4G-Outdoor v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.0.2 Build 20260723 Rel.43271	Unavailable	None listed

DR3150 v1

Vendor: TP-Link Systems Inc.
Product: DR3150 v1
Platforms: Unknown
Default status: unaffected

DR3150 v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.0.1 Build 20260722 Rel.16854	Unavailable	None listed

ER701-5G-Outdoor v1

Vendor: TP-Link Systems Inc.
Product: ER701-5G-Outdoor v1
Platforms: Unknown
Default status: unaffected

ER701-5G-Outdoor v1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	1.0.3 Build 20260723 Rel.40931	Unavailable	None listed

ER605W v2

Vendor: TP-Link Systems Inc.
Product: ER605W v2
Platforms: Unknown
Default status: unaffected

ER605W v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.0.4 Build 20260723 Rel.43763	Unavailable	None listed