CVE-2026-19586 is a critical pre-authentication OS command injection flaw (CVSS 9.8) in TP-Link Omada gateways that run as an OpenVPN server. An unauthenticated remote attacker could run commands and take over the device. TP-Link has released fixed firmware for the affected models, so update or disable the VPN server.
What's affected
Omada gateways configured as an OpenVPN server are affected, including models such as the DR3150 and DR3220v-4G named in the record. A researcher's write-up says the shared VPN authentication code appears across the Omada gateway range, and that TP-Link has released fixed firmware for models including the ER605, ER7206, ER8411 and DR3650v. The TP-Link advisory holds the full list of models and build numbers.
Exploitation requires three things, per the record: the OpenVPN Server feature is on, the VPN service is reachable, and the attacker can start a connection attempt.
How to check if you're exposed
In the Omada controller or the gateway's web page, check the model, hardware version and firmware build, then check whether an OpenVPN server is enabled under the VPN settings. Compare the build with the fixed firmware list on TP-Link's download page for your model and hardware version.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- List your Omada gateways with model, hardware version and firmware build.
- Download the fixed firmware for each from TP-Link and install it.
- If you cannot update at once, disable the OpenVPN server feature.
- Do not expose the VPN service to the internet beyond what you need, and review the device for unexpected changes if it was exposed.
Why it matters
OS command injection, CWE-78, means input from a client is placed into a command that the device runs. Here that happens during VPN connection setup, before authentication completes, so there is no login to stand in the way. A gateway holds the keys to the network behind it, so a takeover is serious.
The record's text says a successful attack could fully compromise the device. The CVE is not in CISA's KEV list and the record does not report attacks in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I safe if the OpenVPN server is off?
The record says exploitation requires the feature to be enabled. Update the firmware anyway.
Where is the full model list?
In TP-Link's advisory and download pages, linked in the record.
Sources
Last reviewed: 19 October 2026.
