CVE-2025-6541: OS command injection using information obtained from the web management interface

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-21 · updated 2026-10-18
Weakness: CWE-78

Description

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Affected products

TP-Link Er605 Firmware: before 2.3.1; 2.3.1 — fixed in 2.3.1
TP-Link Er706W-4G Firmware: before 1.2.1; 1.2.1 — fixed in 1.2.1
TP-Link Er706W Firmware: before 1.2.1; 1.2.1 — fixed in 1.2.1
TP-Link Er707-M2 Firmware: before 1.3.1; 1.3.1 — fixed in 1.3.1
Tp-Link ER7206 Omada Gigabit VPN Router: before 2.2.2; 2.2.2 — fixed in 2.2.2
TP-Link Er7212Pc Firmware: before 2.1.3; 2.1.3 — fixed in 2.1.3
TP-Link Er7412-M2 Firmware: before 1.1.0; 1.1.0 — fixed in 1.1.0
TP-Link Er8411 Firmware: before 1.3.3; 1.3.3 — fixed in 1.3.3
TP-Link Fr205 Firmware: before 1.0.3; 1.0.3 — fixed in 1.0.3
TP-Link Fr307-M2 Firmware: before 1.2.5; 1.2.5 — fixed in 1.2.5
TP-Link Fr365 Firmware: before 1.1.10; 1.1.10 — fixed in 1.1.10
TP-Link G36 Firmware: before 1.1.4; 1.1.4 — fixed in 1.1.4
TP-Link G611 Firmware: before 1.2.2; 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: TP-Link Er605 Firmware 2.3.1; TP-Link Er706W-4G Firmware 1.2.1; TP-Link Er706W Firmware 1.2.1; TP-Link Er707-M2 Firmware 1.3.1; Tp-Link ER7206 Omada Gigabit VPN Router 2.2.2; TP-Link Er7212Pc Firmware 2.1.3; TP-Link Er7412-M2 Firmware 1.1.0; TP-Link Er8411 Firmware 1.3.3; TP-Link Fr205 Firmware 1.0.3; TP-Link Fr307-M2 Firmware 1.2.5; TP-Link Fr365 Firmware 1.1.10; TP-Link G36 Firmware 1.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-6541 or the next vulnerability affects your stack