CVE-2024-1180 is a High severity command injection in the access control interface of the TP-Link Omada ER605 router, scored 8.0 in the record. ZDI scores it 6.8. An authenticated attacker can run code as root. ZDI lists firmware ER605(UN)_V2_2.2.3 Build 20231201 as the fix.
What's affected
The record lists the Omada ER605 firmware and ER605 version 2.0 hardware. ZDI-24-086 gives no version range and names the fixed firmware as ER605(UN)_V2_2.2.3 Build 20231201.
Severity differs. The record gives 8.0 (High). ZDI gives CVSS 3.0 6.8 (Medium) with vector AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high privileges required. The record's lower privilege requirement lifts its score. Both are shown here, and the title follows the record.
How to check if you're exposed
Read the firmware version in the router's web page or the Omada controller and compare it with ER605(UN)_V2_2.2.3 Build 20231201. Note that the fix for the sibling CVE-2024-1179 is a newer build, 2.2.4 Build 20240119, so aim for the newer one.
Also check who has an administrator account on the router, since the flaw needs a login.
What to do now
- List ER605 routers and their firmware.
- Update to the newest firmware from TP-Link, at least ER605(UN)_V2_2.2.4 Build 20240119 to cover this CVE and CVE-2024-1179 together.
- Review administrator accounts on the router and change shared passwords.
- Restrict the management interface to a management network.
- Back up the configuration before upgrading.
Why it matters
The class is OS command injection, CWE-78. ZDI says the issue is in the handling of the name field in the access control user interface: a user supplied string is used in a system call without proper validation. Code then runs as root.
The need for a login makes it less alarming than an open flaw, but small office routers often use default or shared admin passwords. A flaw that turns any administrator login into root on the underlying system is worth the firmware update. The record's KEV flag is false.
Quick check
Which firmware fixes CVE-2024-1180?
ZDI names ER605(UN)_V2_2.2.3 Build 20231201. Moving to the 2.2.4 build also covers CVE-2024-1179.
Do I need credentials to exploit it?
Yes, according to the record and the ZDI advisory.
Sources
Last reviewed: 19 October 2026.
