CVE-2025-7851 is a critical (CVSS 9.8) privilege escalation to a root shell in Omada gateways (ER605, ER706W, ER707-M2 and related). The record scores it 9.8 under CVSS 3.1, while TP-Link scores it 8.7 High under CVSS 4.0. Upgrade each gateway to the fixed firmware build for its model in the vendor advisory, then change the device password.
What's affected
The record lists the Omada gateway models listed in the record as affected.
TP-Link's advisory lists a fixed firmware build per model. For example ER605 2.3.1 Build 20251015 Rel.78291, ER706W 1.2.1 Build 20250821 Rel.80909 and ER707-M2 1.3.1 Build 20251009 Rel.67687.
Forescout's research blog describes the issue as residual debug code in the cli_server binary that allows root logins. It says this was a partial fix for the earlier CVE-2024-21827, and that the researchers reached the root path by chaining it with CVE-2025-7850, which needs authenticated web UI access. The article does not say whether CVE-2025-7851 needs authentication on its own.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a score of 9.8. The vendor advisory tells you to upgrade to the fixed firmware for your model and then change the device password, because passwords may have been exposed.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
Open each gateway's web interface and read the firmware version, or read it from your Omada controller's device list. Compare it to the fixed build for that model in TP-Link's advisory. Anything below the fixed build is affected.
Note that the advisory lists thirteen models in one table shared with a second CVE, and does not say which rows apply to CVE-2025-7851 alone. Check every gateway you run against the table rather than only the models named in the record.
nmap -Pn -p 22,80,443,8043 YOUR_GATEWAY_ADDRESS
Management ports and SSH should not answer from the internet.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Find every Omada gateway you run and read its firmware build.
- Upgrade each one to the fixed build for its model from the TP-Link advisory.
- Change the device password after upgrading. The advisory warns that passwords may have been exposed.
- Remove WAN side access to the web interface and SSH, and restrict management to a trusted network.
- Review your controller and device logs for administrative logins you cannot explain.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-269 (improper privilege management). Forescout's write-up describes leftover debug code that grants root access, which is a reminder that debug paths shipped in production firmware tend to outlive the fix that was meant to close them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-7851?
TP-Link's advisory lists a fixed firmware build per model. For example ER605 2.3.1 Build 20251015 Rel.78291, ER706W 1.2.1 Build 20250821 Rel.80909 and ER707-M2 1.3.1 Build 20251009 Rel.67687.
Is CVE-2025-7851 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-7851
- TP-Link Omada security advisory
- Forescout research blog on TP-Link router vulnerabilities
- NVD record data for CVE-2025-7851, published 2025-10-21, source f23511db-6c3e-4e32-a477-6aa17d310630
Last reviewed: 18 October 2026.
