TP-Link System Inc. has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.2 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- Omada Software Controller 1
- Omada Software Controller (Windows) 1
- TL-WR841N v14 1
- Tapo S505 v1.6 1
Worst active — by depth score
CVE-2026-102294High· 8.5TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration47CVE-2026-102298High· 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check41CVE-2026-81531Medium· 6.9An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated …38CVE-2026-102368Medium· 5.4Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage30
TP-Link System Inc. vulnerabilities
CVEs affecting TP-Link System Inc., newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-102298High· 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receiv…
CVE-2026-102368Medium· 5.4Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage
Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successf…
CVE-2026-102294High· 8.5TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execu…
CVE-2026-81531Medium· 6.9An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated …
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated …