CVE-2024-5242PoC(tp-link / omada_er605)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for tp-link omada_er605 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The specific flaw exists within the handling of DDNS error codes. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22522.

tp-link CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

omada_er605
omada_er605_firmware

Threat summary

Public PoC and exploit tooling are both present
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-02-06); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

tp-link

Products

omada_er605omada_er605_firmware

2 versions affected across 2 products

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

PoC

150.0%

Exploit

150.0%

Referenced assets1 URL

By indicator

https://oobs.io/posts/er605-1day-exploit/

Classification over time

Date	Total	Labels

2026-02-06	1	PoC1
2026-02-08	1	Exploit1

Full discourse2 posts

Out of Bounds@oobs_io245d
PoC
Technical analysis of the TP-Link ER605 Pre-Auth RCE exploit chain by @yibarrack. This writeup documents the reproduction of CVE-2024-5242, 5243, and 5244, detailing a 2-stage exploitation process to bypass ASLR on MIPS32 LE. Full report: https://oobs.io/posts/er605-1day-exploit/
Post summary
The post documents a reproduced pre‑authentication RCE chain for CVE‑2024‑5242/5243/5244, including a 2‑stage ASLR bypass and a link to a detailed report, but it does not report active exploitation or offer a patch.
225178355.4K
159 followersView on X
Blackstorm Security@blackstormsecbr243d
Exploit
TP-Link ER605 DDNS Pre-Auth RCE: Chaining CVE-2024-5242, CVE-2024-5243, CVE-2024-5244: https://oobs.io/posts/er605-1day-exploit/ #exploit #vulnerability #rce #informationsecurity #cybersecurity #infosec https://t.co/RulxemI2kQ
Post summary
The tweet announces a pre‑authentication remote code execution chain for TP‑Link ER605 devices, linking to a 1‑day exploit and PoC, with no mention of patches or active exploitation.
0502891.3K
1.8K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	omada_er605	2.6	-	-
OS	tp-link	omada_er605_firmware	2.2.2	-	-

Explore more

Back to dashboard tp-link CVEs omada_er605 vulnerabilities