CVE-2025-6541

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
TP-Link Systems Inc.Omada gateways< ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
TP-Link Systems Inc.Festa gateways< FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
TP-Link Systems Inc.Omada Pro gateways< G36 1.1.4, G611 1.2.2

References

Timeline

Published
Oct 21, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-654106.2A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a craftCVE-2025-654117.5A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injectiCVE-2025-654155.4docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application.CVE-2025-654166.3docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php.CVE-2025-654176.1docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application.CVE-2025-654187.5docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted uCVE-2025-65429.8An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.CVE-2025-654276.5An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to CVE-2025-65439.8Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configureCVE-2025-654305.4An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user whCVE-2025-654315.4An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-partCVE-2025-65449.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute ar
CVE-2025-6541: High severity, CVSS 8.8 | Vulnix