Cyber Resilience

CVE-2025-7850

Critical

Published: 21 October 2025

Published
21 October 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0066 71.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7850 is a critical-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Er8411 Firmware. Its CVSS base score is 9.3 (Critical).

Operationally, ranked in the top 28.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-7850 is a command injection vulnerability (CWE-78) affecting Omada gateways. The flaw is present in the web portal component and can be reached only after an administrator has authenticated.

An attacker with administrative credentials on an adjacent network can supply crafted input that results in arbitrary command execution. Successful exploitation yields high impact to device confidentiality, integrity, and availability, along with limited impact beyond the vulnerable component.

Vendor advisories and firmware updates addressing the issue are referenced in Omada Networks support documentation and related product pages.

The EPSS score rose from a low baseline of 0.0066 to a peak of 0.0194 on 2026-02-20 before receding, indicating post-disclosure exploitation interest that later subsided.

EU & UK References

Vulnerability details

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tp-link
er8411 firmware
1.3.3 · ≤ 1.3.3
tp-link
er7412-m2 firmware
1.1.0 · ≤ 1.1.0
tp-link
er707-m2 firmware
1.3.1 · ≤ 1.3.1
tp-link
er7206 firmware
2.2.2 · ≤ 2.2.2
tp-link
er605 firmware
2.3.1 · ≤ 2.3.1
tp-link
er706w firmware
1.2.1 · ≤ 1.2.1
tp-link
er706w-4g firmware
1.2.1 · ≤ 1.2.1
tp-link
er7212pc firmware
2.1.3 · ≤ 2.1.3
tp-link
g36 firmware
1.1.4 · ≤ 1.1.4
tp-link
g611 firmware
1.2.2 · ≤ 1.2.2
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References