Vulnerability · Published Oct 21, 2025 · Assigned by TPLink
CVE-2025-6541OS command injection using information obtained from the web management interface
High 8.6
In plain English
A high-severity OS command injection in Festa gateways from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Omada gateways | 0 – before ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 |
| TP-Link Systems Inc. | Festa gateways | 0 – before FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 |
| TP-Link Systems Inc. | Omada Pro gateways | 0 – before G36 1.1.4, G611 1.2.2 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://support.omadanetworks.com/en/document/108455/ vendor-advisory
- https://www.omadanetworks.com/us/business-networking/all-omada-router/ product
- https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ product
- https://www.tp-link.com/us/business-networking/soho-festa-gateway/ product