What’s Vulnerable › Vulnerabilities

CVE-2025-14737: Command Injection Vulnerability in TP-Link WA850RE

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-18 · updated 2026-06-17
• Weakness: CWE-78

Description

Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.

Affected products

• TP-Link Systems Inc. WA850RE: through 160527; through 160922

References

• https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-remote-command-injection-vulnerability/
• https://www.tp-link.com/us/support/download/tl-wa850re/v2/#Firmware
• https://www.tp-link.com/us/support/download/tl-wa850re/v3/#Firmware
• https://www.tp-link.com/us/support/faq/4848/

Get alerted when CVE-2025-14737 or the next vulnerability affects your stack