CVE-2026-1668 is a critical (CVSS 9.8 in NVD) input validation flaw in the web interface of many TP-Link Omada switches. Crafted requests can cause out-of-bounds memory access and, under some conditions, command execution. TP-Link published fixed firmware per model, so update each switch to the build in its advisory.
What's affected
TP-Link Omada managed switches in the SG and related lines. The NVD record lists the SG2005P-PD, SG2008, SG2008P and SG2016P among others, and TP-Link's advisory (dated 13 March 2026) lists many more, including SG2210MP, SG3428, SG3452 and the SX3008F and SX3016F models.
Fixed firmware depends on both the model and the hardware branch. For example, TP-Link lists 4.20.17 Build 20260121 Rel.53429 for the SG2008 hardware branch 4.2x and 4.30.1 Build 20260127 Rel.32017 for branch 4.3x. Read the table for your exact model and hardware version, and do not guess from the model name alone.
TP-Link scores the issue as 7.7 (High) on CVSS v4.0 with an adjacent network vector, while the NVD record shows 9.8 on v3.1 with a network vector. Treat the web interface as sensitive either way.
How to check if you're exposed
Open each switch's web interface or the Omada controller and note the model, hardware version and firmware build. Match them against the table in TP-Link's advisory. A firmware build older than the listed fixed one is affected.
Also find out who can reach the management interface. The advisory describes an attacker with network access to the affected interface, so a switch whose web UI is reachable from user VLANs, guest networks or the internet is the highest priority.
What to do now
- Build a list of Omada switches with model, hardware version and firmware.
- Download the fixed firmware from TP-Link for each model and hardware branch, and update.
- Restrict the management web interface to a dedicated management VLAN or trusted hosts.
- Make sure no switch management page is exposed to the internet.
- Recheck firmware versions after the update.
Why it matters
The weakness is a mix of CWE-20 (Improper Input Validation), CWE-787 (Out-of-bounds Write). The web interface did not validate certain external inputs well enough, and a crafted request could read or write memory outside its intended bounds. TP-Link says that under specific conditions this may lead to unintended command execution.
Network devices are easy to forget. They rarely sit in the same patch process as servers, and they run for years. A switch that an attacker can crash or control is a foothold inside the network. CISA does not list this CVE as known exploited, and the vendor advisory does not report exploitation.
Quick check
The vendor score and NVD score differ. Which one is right?
Both describe the same flaw from different views. TP-Link scored 7.7 on CVSS v4.0 with an adjacent vector, and NVD shows 9.8 on v3.1. Patch on your own exposure, mainly who can reach the web interface.
Sources
Last reviewed: 19 October 2026.
