Permissions, Privileges, and Access Controls in TP-Link products - CVE-2025-7851

Vulnerability identifier: #VU117542

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-7851

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due improperly imposed security restrictions. A remote authenticated user can obtain root privileges on the device. 

Omada FR205
Omada ER7412-M2
Omada G36
Omada FR365
Omada ER706W
Omada ER706W-4G
Omada G611
Omada FR307-M2
Omada ER707-M2
Omada ER8411
Omada ER7212PC
Omada ER7206
Omada ER605

Install updates from vendor's website.

Omada FR205 - update to 1.0.3 20251016 Rel.61376
Omada ER7412-M2 - update to 1.1.0 20251015 Rel.63594
Omada G36 - update to 1.1.4 20251015 Rel.84206
Omada FR365 - update to 1.1.10 20250626 Rel.81746
Omada ER706W - update to 1.2.1 20250821 Rel.80909
Omada ER706W-4G - update to 1.2.1 20250821 Rel.82492
Omada G611 - update to 1.2.2 20251017 Rel.45512
Omada FR307-M2 - update to 1.2.5 20251015 Rel.76743
Omada ER707-M2 - update to 1.3.1 20251009 Rel.67687
Omada ER8411 - update to 1.3.3 20251013 Rel.44647
Omada ER7212PC - update to 2.1.3 20251016 Rel.82571
Omada ER7206 - update to 2.2.2 20250724 Rel.11109
Omada ER605 - update to 2.3.1 20251015 Rel.78291

• https://support.omadanetworks.com/en/document/108456/

• Multiple vulnerabilities in TP-Link Omada gateways