CVE-2026-19586 (CVSS 9.3): Pre-Authentication OS Command Injection Hits Omada Gateways

TL;DR

TP-Link patched three Omada gateway vulnerabilities. The most severe, CVE-2026-19586, is a pre-authentication OS command injection rated CVSS 9.3. It affects gateways running as an OpenVPN Server. No exploitation in the wild or public proof-of-concept has been confirmed.

Why This Omada Gateway Flaw Matters

Omada gateways sit at the edge of many business networks. Therefore a critical flaw here can expose an entire site. CVE-2026-19586 needs no login at all. An attacker can strike before authentication finishes. TP-Link documented the issue in its official Omada security advisory.

How the Pre-Authentication OS Command Injection Works

The flaw lives in the OpenVPN Server feature. The gateway does not validate client-supplied data well enough during connection setup. As a result, a crafted input can influence backend command logic. According to the advisory, an attacker can influence “command execution logic before authentication completes.”

Success can be severe. The advisory warns it “may allow arbitrary command execution, potentially leading to full compromise of the affected device.” However, three conditions must hold. The OpenVPN Server must be enabled, reachable, and open to a connection attempt.

The Other Two Flaws

CVE-2026-19683 sends DDNS credentials over an unencrypted channel. So a network attacker can capture sensitive authentication data. CVE-2026-9033 lets an unauthenticated attacker drop captive portal sessions, forcing users to log in again.

Affected Versions

The advisory lists many models. These include the ER605, ER7206, ER8411, ER707-M2, and several DR-series gateways. Each model has its own fixed firmware build.

Patch and Mitigation Steps

Update affected devices to the latest fixed firmware first. If you cannot patch right away, disable the OpenVPN Server feature. Alternatively, the advisory says to “restrict access to the OpenVPN service to trusted networks.” Keep the service off the public internet unless it is required.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.