TP-Link System Inc.
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| TL-WR841N v14 | 4 | – | Oct 1, 2026 |
| Archer C1200 | 1 | – | Jul 16, 2025 |
| Omada Software Controller | 1 | – | Sep 8, 2026 |
| Archer BE230 v1.2 | 1 | – | Feb 2, 2026 |
| Tapo S505 v1.6 | 1 | – | Oct 8, 2026 |
| TL-WR940N V6 | 1 | – | Nov 20, 2025 |
| Omada Software Controller (Windows) | 1 | – | Oct 14, 2026 |
Exploited and recent CVEs
- CVE-2026-102298 Insufficient Authorization and User Boundary Validation in Omada Controller MSP 0.4%
- CVE-2026-102368 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware 0.1%
- CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration 0.9%
- CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers 0.7%
- CVE-2026-76651 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N 0.4%
- CVE-2026-76650 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N 0.3%
- CVE-2026-76649 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N 0.3%
- CVE-2026-22223 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1 1.4%
- CVE-2025-11676 UPnP DOS in TL-WR940N V6 0.2%
- CVE-2025-6983 Clickjacking vulnerability on the management web application of TP-LINK Archer C1200 0.5%