CVE-2026-19683 is a high severity (CVSS 7.4) flaw in the Dynamic DNS feature of TP-Link Omada gateways, which send authentication credentials to a third party DDNS service over an unencrypted channel. Update your gateway to the fixed firmware listed in the Omada advisory for your model.
What's affected
The record lists the TP-Link DR3150, DR3220v-4G, DR3650v and DR3650v-4G among the affected products. The Omada advisory we read is a shared table for several CVEs and lists 19 gateway models with a fixed firmware for each, including ER605 v2, ER7206 v2, ER8411 v1, ER706W, ER707-M2 and DR3150 v1. So the real list is wider than the record's.
Examples of fixed builds from that table: ER605 v2 at 2.4.4 Build 20260630 Rel.14398, ER8411 v1 at 1.4.1 Build 20260708 Rel.64832, and DR3150 v1 at 1.0.1 Build 20260722 Rel.16854. Look up your exact model and hardware version in the advisory, because the fixed build differs for each.
The score is 7.4 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The weakness is CWE-319 (cleartext transmission of sensitive information). The KEV flag is false.
Exploitation needs three things at once: DDNS configured, communication with an external DDNS service, and an attacker who can see or control the network path. The advisory has no workaround for this CVE, only the firmware update.
How to check if you're exposed
In the Omada controller or the gateway's web interface, note the model, hardware version and current firmware. Compare with the fixed builds in the Omada advisory.
Then check whether Dynamic DNS is turned on. In the gateway's network or service settings, look for the DDNS section and which provider is configured. If DDNS is off, the exploitation conditions in the advisory are not met, though you should still plan the update. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- List every Omada gateway, with hardware version, at all sites.
- Download the matching fixed firmware from the Omada Download Center.
- Update gateways that use DDNS first, since they meet the precondition.
- Change the DDNS account password after the update, because the old one may have been sent unencrypted.
- Where you can, replace DDNS with a static address or a method that does not need a password on the router.
- Check the DDNS provider's account log for updates you did not make.
Why it matters
CWE-319 (cleartext transmission of sensitive information) is a simple mistake with a clear fix: send secrets over an encrypted channel. When a device logs into a DDNS service in clear text, anyone on the path between the router and that service can read the password. A router sits at the edge, so that path often crosses networks you do not control.
The damage is bounded. The attacker gets DDNS credentials, or can interfere with address updates, which could point a hostname somewhere else. That is a real issue for remote access setups that rely on the DDNS name. Changing the credential after patching closes the gap that the old traffic left.
Quick check
Does the update fix this on every Omada model?
The advisory lists a fixed firmware for each of 19 models. Find your model and hardware version in that table. A model not in the table needs a direct check with TP-Link.
If I rotate the DDNS password, am I safe?
Rotation helps after the fix. Before the fix, the new password would also go out unencrypted, so update the firmware first.
Sources
Last reviewed: 18 October 2026.
