CVE-2026-1668: Input Validation Vulnerability on Multiple Omada Switches

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-13 · updated 2026-06-17
Weakness: CWE-20

Description

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

Affected products

TP-Link Omada Sg2005P-Pd Firmware: from 1.0.0 before 1.0.19 — fixed in 1.0.19
TP-Link Omada Sg2008 Firmware: from 4.20.0 before 4.20.17; from 4.30.0 before 4.30.1 — fixed in 4.20.17, 4.30.1
TP-Link Omada Sg2008P Firmware: from 3.20.0 before 3.20.17; from 3.30.0 before 3.30.1 — fixed in 3.20.17, 3.30.1
TP-Link Omada Sg2016P Firmware: from 1.20.0 before 1.20.17; from 1.30.0 before 1.30.1 — fixed in 1.20.17, 1.30.1
TP-Link Omada Sg2210Mp Firmware: from 4.20.0 before 4.20.18; from 5.0.0 before 5.0.15; from 5.20.0 before 5.20.1 — fixed in 4.20.18, 5.0.15, 5.20.1
TP-Link Omada Sg2210P Firmware: from 5.20.0 before 5.20.18; from 5.30.0 before 5.30.1 — fixed in 5.20.18, 5.30.1
TP-Link Omada Sg2210Xmp-M2 Firmware: from 1.0.0 before 1.0.19 — fixed in 1.0.19
TP-Link Omada Sg2218 Firmware: from 1.20.0 before 1.20.17; from 1.30.0 before 1.30.1 — fixed in 1.20.17, 1.30.1
TP-Link Omada Sg2218P Firmware: from 1.20.0 before 1.20.17; from 2.0.0 before 2.0.14; from 2.20.0 before 2.20.2 — fixed in 1.20.17, 2.0.14, 2.20.2
TP-Link Omada Sg2428Lp Firmware: from 1.0.0 before 1.0.13 — fixed in 1.0.13
TP-Link Omada Sg2428P Firmware: from 5.20.0 before 5.20.20; from 5.30.0 before 5.30.16 — fixed in 5.20.20, 5.30.16
TP-Link Omada Sg2452Lp Firmware: from 1.0.0 before 1.0.13 — fixed in 1.0.13
TP-Link Omada Sg3210 Firmware: from 3.20.0 before 3.20.17; from 3.30.0 before 3.30.1 — fixed in 3.20.17, 3.30.1
TP-Link Omada Sg3210X-M2 Firmware: from 1.20.0 before 1.20.1 — fixed in 1.20.1
TP-Link Omada Sg3210Xhp-M2 Firmware: from 3.0.0 before 3.0.21 — fixed in 3.0.21
TP-Link Omada Sg3218Xp-M2 Firmware: from 1.0.0 before 1.0.19 — fixed in 1.0.19
TP-Link Omada Sg3428 Firmware: from 2.30.0 before 2.30.16; from 2.40.0 before 2.40.1 — fixed in 2.30.16, 2.40.1
TP-Link Omada Sg3428Mp Firmware: from 6.20.0 before 6.20.20; from 6.30.0 before 6.30.1 — fixed in 6.20.20, 6.30.1
TP-Link Omada Sg3428X-M2 Firmware: from 1.20.0 before 1.20.18 — fixed in 1.20.18
TP-Link Omada Sg3428X Firmware: from 1.30.0 before 1.30.17; from 1.40.0 before 1.40.1 — fixed in 1.30.17, 1.40.1
TP-Link Omada Sg3428Xf Firmware: from 1.20.0 before 1.20.16; from 1.30.0 before 1.30.1 — fixed in 1.20.16, 1.30.1
TP-Link Omada Sg3428Xmp Firmware: from 3.20.0 before 3.20.21; from 3.30.0 before 3.30.1 — fixed in 3.20.21, 3.30.1
TP-Link Omada Sg3428Xmpp Firmware: from 1.0.0 before 1.0.16; from 1.20.0 before 1.20.1 — fixed in 1.0.16, 1.20.1
TP-Link Omada Sg3428Xpp-M2 Firmware: from 1.20.0 before 1.20.19 — fixed in 1.20.19
TP-Link Omada Sg3452 Firmware: from 1.20.0 before 1.20.17; from 1.30.0 before 1.30.1 — fixed in 1.20.17, 1.30.1
TP-Link Omada Sg3452P Firmware: from 3.30.0 before 3.30.17; from 3.40.0 before 3.40.1 — fixed in 3.30.17, 3.40.1
TP-Link Omada Sg3452X Firmware: from 1.20.0 before 1.20.18; from 1.30.0 before 1.30.1 — fixed in 1.20.18, 1.30.1
TP-Link Omada Sg3452Xmpp Firmware: from 1.0.0 before 1.0.15 — fixed in 1.0.15
TP-Link Omada Sg3452Xp Firmware: from 2.20.0 before 2.20.20; from 2.30.0 before 2.30.1 — fixed in 2.20.20, 2.30.1
TP-Link Omada Sl2428P Firmware: from 6.20.0 before 6.20.18 — fixed in 6.20.18

How to fix

Upgrade to a fixed version: TP-Link Omada Sg2005P-Pd Firmware 1.0.19; TP-Link Omada Sg2008 Firmware 4.20.17, 4.30.1; TP-Link Omada Sg2008P Firmware 3.20.17, 3.30.1; TP-Link Omada Sg2016P Firmware 1.20.17, 1.30.1; TP-Link Omada Sg2210Mp Firmware 4.20.18, 5.0.15, 5.20.1; TP-Link Omada Sg2210P Firmware 5.20.18, 5.30.1; TP-Link Omada Sg2210Xmp-M2 Firmware 1.0.19; TP-Link Omada Sg2218 Firmware 1.20.17, 1.30.1; TP-Link Omada Sg2218P Firmware 1.20.17, 2.0.14, 2.20.2; TP-Link Omada Sg2428Lp Firmware 1.0.13; TP-Link Omada Sg2428P Firmware 5.20.20, 5.30.16; TP-Link Omada Sg2452Lp Firmware 1.0.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-1668 or the next vulnerability affects your stack