CVE-2025-6542

An attacker sends a specially crafted network request to the vulnerable device without needing any authentication credentials. The injected command (command injection) is then executed by the device's operating system with the privileges of the process handling the request. The vulnerability results from insufficient validation or sanitization of input data passed to system functions, classifying it as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

An attacker can execute arbitrary commands at the operating system level on the device, which in practice means complete takeover of the router — including the ability to change network configuration, intercept network traffic, install backdoors, and use the device as an entry point to the internal network.

Patches available from the manufacturer must be applied immediately in accordance with the document published at https://support.omadanetworks.com/en/document/108455/. Additionally, it is recommended to restrict access to the device management interface only to trusted IP addresses and prevent exposure of the administrative panel to untrusted networks (e.g., the Internet).

TP-Link devices: FR307-M2 (firmware), G36, ER707-M2, ER706W (firmware), ER7206 (firmware) — specific versions of vulnerable software indicated in the manufacturer's references.