CVE-2026-1668
Published: 13 March 2026
Summary
CVE-2026-1668 is a high-severity Improper Input Validation (CWE-20) vulnerability in Tp-Link Omada Sg2210Mp Firmware. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-1668 is a vulnerability in the web interface on multiple Omada switches, where certain external inputs are not adequately validated. This deficiency can lead to out-of-bounds memory access when processing crafted requests. Under specific conditions, the flaw may result in unintended command execution. The issue is linked to CWE-20 (Improper Input Validation) and CWE-787 (Out-of-bounds Write), with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with network access to the affected interface can exploit this vulnerability to cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
Omada Networks provides mitigation through firmware updates available on their support sites, including regional download pages at https://support.omadanetworks.com/au/download/firmware/, https://support.omadanetworks.com/en/download/firmware/, and https://support.omadanetworks.com/us/download/firmware/, along with detailed documentation at https://support.omadanetworks.com/us/document/118794/ and product information at https://support.omadanetworks.com/us/product/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12049
Vulnerability details
The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network…
more
access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of the web interface on network switches for RCE or DoS directly enables T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces input validation mechanisms to prevent crafted requests from causing out-of-bounds memory access in the web interface.
Implements memory protection techniques like address space randomization to mitigate out-of-bounds writes leading to memory corruption or RCE.
Ensures timely identification, reporting, and patching of flaws like this input validation vulnerability via firmware updates.