Tp-link vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Tp-link flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-9377 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command InjectionExploited since Sep 3, 2025 · CVSS 8.6
• CVE-2023-50224 TP-Link TL-WR841N Authentication Bypass by SpoofingExploited since Sep 3, 2025 · CVSS 6.5
• CVE-2020-24363 TP-link TL-WA855RE Missing Authentication for Critical FunctionExploited since Sep 2, 2025 · CVSS 8.8
• CVE-2023-33538 TP-Link Multiple Routers Command InjectionExploited since Jun 16, 2025 · CVSS 8.8
• CVE-2023-1389 TP-Link Archer AX-21 Command InjectionExploited since May 1, 2023 · CVSS 8.8
• CVE-2015-3035 TP-Link Multiple Archer Devices Directory TraversalExploited since Mar 25, 2022 · CVSS 7.5

Latest high and critical flaws

• CVE-2026-102814 An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3.High 8.7 · Oct 27, 2026
• CVE-2026-105815 TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests.High 7.1 · Oct 19, 2026
• CVE-2026-105810 Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path.High 8.5 · Oct 19, 2026
• CVE-2026-107795 Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user High 7.5 · Oct 14, 2026
• CVE-2026-108473 Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol.High 8.7 · Oct 13, 2026
• CVE-2026-105674 TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key High 8.7 · Oct 8, 2026
• CVE-2026-105673 An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enaHigh 7.1 · Oct 8, 2026
• CVE-2026-105672 TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443.High 8.7 · Oct 8, 2026
• CVE-2026-104944 TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon.High 7.1 · Oct 6, 2026
• CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request datHigh 7.7 · Oct 1, 2026
• CVE-2026-84682 A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1.High 7.7 · Oct 1, 2026
• CVE-2026-9032 Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser.High 7.1 · Oct 1, 2026
• CVE-2026-78578 Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.High 7.1 · Oct 1, 2026
• CVE-2026-102369 Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler.High 8.7 · Oct 1, 2026
• CVE-2026-17176 An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands withHigh 7.7 · Sep 10, 2026
• CVE-2026-85384 A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when procesHigh 8.5 · Sep 8, 2026
• CVE-2026-18167 A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4.High 7.7 · Sep 3, 2026
• CVE-2026-75118 A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking ofHigh 8.7 · Aug 28, 2026
• CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol.High 8.7 · Aug 26, 2026
• CVE-2026-78541 A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1.High 8.5 · Aug 24, 2026
• CVE-2026-9254 An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper fiHigh 8.7 · Aug 24, 2026
• CVE-2026-16348 An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands wHigh 8.5 · Aug 24, 2026
• CVE-2026-15469 The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.High 7.7 · Aug 24, 2026
• CVE-2026-17252 A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 rHigh 7.1 · Aug 21, 2026
• CVE-2026-17251 A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6400 v7.High 7.1 · Aug 21, 2026