CVE-2025-6542 is a critical OS command injection in TP-Link Omada gateways. A remote attacker with no login can run arbitrary commands on the device. The record scores it 9.8 and TP-Link's statement scores it 9.3 on CVSS 4.0. Update each affected model to the fixed firmware build listed by TP-Link.
What's affected
The record names the ER605, ER706W, ER706W-4G and ER707-M2 gateways and their firmware. TP-Link's statement covers CVE-2025-6541 and CVE-2025-6542 together and lists more models. For CVE-2025-6542 the vulnerable and fixed builds for the models in the record are:
- ER605: before 2.3.1 Build 20251015 Rel.78291
- ER706W: before 1.2.1 Build 20250821 Rel.80909
- ER706W-4G: before 1.2.1 Build 20250821 Rel.82492
- ER707-M2: before 1.3.1 Build 20251009 Rel.67687
The statement also lists the ER8411, ER7412-M2, ER7206, ER7212PC, G36, G611, FR365, FR205 and FR307-M2, each with its own fixed build. Check the statement for the exact numbers.
On severity, the record gives CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). TP-Link's statement gives CVSS 4.0 9.3, Critical. The scoring versions differ, but both say critical. Its companion, CVE-2025-6541, needs a login to the web management interface and scores 8.6 High on CVSS 4.0.
How to check if you're exposed
Log in to the gateway's management interface and read the firmware version from the system information page, or read it from the Omada controller's device list. Compare it with the fixed build for your model above.
Then check whether the management interface is reachable from the internet. Review remote management settings and any port forwards that point at the gateway. A management page on a public address makes an unauthenticated flaw much more serious.
If you manage many sites, use the controller to export firmware versions for all gateways and sort by model.
What to do now
- Download the latest firmware for each affected model from TP-Link and update it.
- After the upgrade, check the configuration. TP-Link recommends confirming that settings remain accurate, secure and as intended.
- Turn off remote management from the internet. Use a VPN or the controller's cloud features if you need remote access.
- Restrict management access to a dedicated network or address list.
- Review gateways that were exposed before you patched, looking for unexpected configuration changes, accounts or outbound connections.
Why it matters
The weakness is CWE-78, OS command injection. The device builds an operating system command using input it should have treated as data. A gateway sits at the edge of the network, sees all traffic and often holds VPN and routing credentials, so a command execution flaw there gives an attacker a strong foothold.
Network devices are easy to forget in patch cycles because they have no package manager and no scanner agent. Keep firmware versions in your inventory the same way you track servers. The record does not say this flaw was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why are there two different scores?
The record uses CVSS 3.1 and gives 9.8. TP-Link's statement uses CVSS 4.0 and gives 9.3. Both are critical.
Is CVE-2025-6541 the same flaw?
No. It is a companion command injection that needs a login to the web interface, and TP-Link scores it 8.6 High. The same firmware updates address both.
Sources
Last reviewed: 18 October 2026.
