Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 36 products
| Date | Total | Labels |
|---|
| 2026-08-21 | 3 | General1Patch2 |
| 2026-08-30 | 3 | Disclosure1General2 |
| 2026-09-11 | 2 | Disclosure2 |
TP-Link Omadaに重大(Critical)な脆弱性。CVE-2026-19586はCVSSスコア9.3で無認証OSコマンドインジェクション。ゲートウェイがOpenVPNサーバを起動している場合に影響。実際の悪用やPoC（攻撃の概念実証コード）は未確認。その他脆弱性2件と併せ修正。 https://securityonline.info/cve-2026-19586-omada-command-injection/
Post summary
A critical unauthenticated OS command injection (CVE‑2026‑19586) in TP‑Link Omada with CVSS 9.3 is reported; a patch is noted and no PoC or active exploitation is confirmed.
@__kokumoto Here is my writeup on how I found the issue: https://mattg.systems/posts/cve-2026-19586/
Post summary
The tweet links to a writeup detailing a newly discovered vulnerability, but offers no exploit code, patch information, or evidence of active exploitation.
New blog post: TP-Link Omada SSL VPN Unauthenticated RCE (CVE-2026-19586) (CRITICAL) https://mattg.systems/posts/cve-2026-19586/ A command injection vulnerability within the SSL VPN authentication handling of multiple TP-Link gateways/routers. Some interesting awk injection techniques here.
Post summary
The article announces a critical command injection flaw in TP‑Link Omada SSL VPN routers, without evidence of an exploit, PoC, or patch, and no active exploitation reports.
19機種ぶんの修正版を目で突き合わせると必ず間違えるので、判定スクリプトに落としました。バージョン比較を文字列でやると 2.4.10 が 2.4.4 より古いと判定されます。安全側ではなく危険を見落とす向きに倒れないかを実測で確かめています。 https://blog.hashito.biz/2026/09/11/omada-cve-2026-19586-openvpn-preauth-command-injection/
Post summary
The post links to a blog article announcing CVE‑2026‑19586, an OpenVPN pre‑authentication command injection vulnerability, but it provides no PoC, exploit code, patch, or detailed technical specifics.
TP-Link Omada ゲートウェイに認証前のOSコマンドインジェクション。NVD評価はCVSS 9.8。成立するのはOpenVPNサーバ機能を有効にしている場合だけですが、対象は19機種で修正版の下限が機種ごとに違います。型番だけでなくHWバージョンも確認してください。 https://cve.autoarticles.net/cve/CVE-2026-19586
Post summary
TP‑Link Omada gateways are vulnerable to a pre‑authentication OS command injection (CVE‑2026‑19586) with a CVSS score 9.8, affecting 19 models when OpenVPN is enabled; vendor patches are available and users should verify model and HW version.
@Insylux Here is my writeup on how I found the issue: https://mattg.systems/posts/cve-2026-19586/
Post summary
The post merely references a writeup about CVE‑2026‑19586 without providing any specific technical details, PoC, or evidence of exploitation.
一次情報(NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-19586 参照元(ベンダー等): https://www.omadanetworks.com/en/support/download/, https://www.omadanetworks.com/us/support/download/
Post summary
The post merely links to the NVD entry for CVE‑2026‑19586 and references vendor download pages, without providing additional technical or exploit information.
CVE-2026-19586 (CVSS 9.3) is a pre-authentication OS command injection in TP-Link Omada gateways running OpenVPN Server. Patch the firmware now. #Omada #TPLink #CVE202619586 #CommandInjection #OpenVPN #NetworkSecurity https://securityonline.info/cve-2026-19586-omada-command-injection/
Post summary
The post announces a high‑severity OS command injection vulnerability (CVE‑2026‑19586) in TP‑Link Omada gateways, urging immediate firmware patching.
37 of 37 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tp-link | dr3150 | - | - | - |
| OS | tp-link | dr3150_firmware | - | - | - |
| HW | tp-link | dr3220v-4g | - | - | - |
| OS | tp-link | dr3220v-4g_firmware | - | - | - |
| HW | tp-link | dr3650v | - | - | - |
| HW | tp-link | dr3650v-4g | - | - | - |
| OS | tp-link | dr3650v-4g_firmware | - | - | - |
| OS | tp-link | dr3650v_firmware | - | - | - |
| HW | tp-link | er603wp-4g-outdoor | - | - | - |
| OS | tp-link | er603wp-4g-outdoor_firmware | - | - | - |
| HW | tp-link | er605 | 2.0 | - | - |
| OS | tp-link | er605_firmware | - | - | - |
| HW | tp-link | er605w | 2.0 | - | - |
| OS | tp-link | er605w_firmware | - | - | - |
| HW | tp-link | er701-5g-outdoor | - | - | - |
| OS | tp-link | er701-5g-outdoor_firmware | - | - | - |
| HW | tp-link | er703wp-4g-outdoor | - | - | - |
| OS | tp-link | er703wp-4g-outdoor_firmware | - | - | - |
| HW | tp-link | er706w | - | - | - |
| HW | tp-link | er706w-4g | - | - | - |
| HW | tp-link | er706w-4g | 2.0 | - | - |
| OS | tp-link | er706w-4g_firmware | - | - | - |
| OS | tp-link | er706w_firmware | - | - | - |
| HW | tp-link | er706wp-4g | - | - | - |
| OS | tp-link | er706wp-4g_firmware | - | - | - |
| HW | tp-link | er707-m2 | - | - | - |
| OS | tp-link | er707-m2_firmware | - | - | - |
| HW | tp-link | er7206 | 2.0 | - | - |
| OS | tp-link | er7206_firmware | - | - | - |
| HW | tp-link | er7212pc | 2.0 | - | - |
| OS | tp-link | er7212pc_firmware | - | - | - |
| HW | tp-link | er7406 | - | - | - |
| OS | tp-link | er7406_firmware | - | - | - |
| HW | tp-link | er7412-m2 | - | - | - |
| OS | tp-link | er7412-m2_firmware | - | - | - |
| HW | tp-link | er8411 | - | - | - |
| OS | tp-link | er8411_firmware | - | - | - |