CVE-2025-14737

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527,

≤

WA850RE V3_160922.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	WA850RE	<= WA850RE V2_160527; <= WA850RE V3_160922

References

https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-remote-command-injection-vulnerability/Third Party Advisory
https://www.tp-link.com/us/support/download/tl-wa850re/v2/#FirmwareProduct, Release Notes
https://www.tp-link.com/us/support/download/tl-wa850re/v3/#FirmwareProduct, Release Notes
https://www.tp-link.com/us/support/faq/4848/Vendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-147387.5Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file CVE-2025-147396.8Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute Do CVE-2025-14745.5In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to se CVE-2025-147406.7Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramDa CVE-2025-147419.1The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion CVE-2025-147424.3The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_CVE-2025-147446.5Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking user CVE-2025-147456.4The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2025-147466.5A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video St CVE-2025-147476.5A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the component RTSP Service. Performin CVE-2025-147485.4A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the compo CVE-2025-147498.8A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the compo