OS Command Injection Vulnerability in Omada Gateways by TP-Link
CVE-2026-19586
Key Information:
- Vendor
Tp-link Systems Inc.
- Vendor
- CVE Published:
- 20 August 2026
What is CVE-2026-19586?
A pre-authentication OS command injection vulnerability has been discovered in Omada gateways configured to function as OpenVPN Servers. This vulnerability arises from inadequate validation of client-supplied data during the connection establishment of OpenVPN. An unauthenticated remote attacker can craft specific input that manipulates backend command execution logic before authentication is completed. For exploitation to succeed, the OpenVPN Server feature must be enabled, the VPN service must be accessible by the attacker, and the attacker must be able to initiate an OpenVPN connection attempt. Successful exploitation may lead to arbitrary command execution, potentially resulting in the complete compromise of the affected device.
Affected Version(s)
DR3150 v1 0 < 1.0.1 Build 20260722 Rel.16854
DR3220v-4G v1 0 < 1.2.0 Build 20260630 Rel.82652
DR3650v v1 0 < 1.2.0 Build 20260630 Rel.83311