CVE-2026-19586
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
- Record
CVE-2026-19586- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-63544
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
- Record
EUVD-2026-63544- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-32hp-8pjq-2c8g
A pre-authentication OS command injection vulnerability has been identified in Omada gateways...
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
- Record
GHSA-32hp-8pjq-2c8g- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
- Record
CVE-2026-19586- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
- merit lilin v1
- tp-link dr3150 firmware
- tp-link dr3220v-4g firmware
- tp-link dr3650v-4g firmware
- tp-link dr3650v firmware
- tp-link er603wp-4g-outdoor firmware
- tp-link er605 firmware
- tp-link er605w firmware
- tp-link er701-5g-outdoor firmware
- tp-link er703wp-4g-outdoor firmware
- tp-link er706w-4g firmware
- tp-link er706w firmware
Show 26 moreShow less
- tp-link er706wp-4g firmware
- tp-link er707-m2 firmware
- tp-link er7206 firmware
- tp-link er7212pc firmware
- tp-link er7406 firmware
- tp-link er7412-m2 firmware
- tp-link er8411 firmware
- tp-link systems inc er7406 v1
- tp-link systems inc er7412-m2 v1
- tp-link systems inc. dr3150 v1
- tp-link systems inc. dr3220v-4g v1
- tp-link systems inc. dr3650v v1
- tp-link systems inc. dr3650v-4g v1
- tp-link systems inc. er603wp-4g-outdoor v1
- tp-link systems inc. er605 v2
- tp-link systems inc. er605w v2
- tp-link systems inc. er701-5g-outdoor v1
- tp-link systems inc. er703wp-4g-outdoor v1
- tp-link systems inc. er706w v1
- tp-link systems inc. er706w-4g v2
- tp-link systems inc. er706wp-4g v1
- tp-link systems inc. er707-m2 v1
- tp-link systems inc. er7206 v2
- tp-link systems inc. er7212pc v2
- tp-link systems inc. er8411 v1
- tp-link systems inc. v1
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mattgsys/CVE-2026-19586 | 2026-08-21 |
| PoC in GitHub | bgorzelic/omada-advisory-check | 2026-11-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | PoC in GitHub | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19586 is a critical vulnerability (CVSS 9.3) in Merit Lilin V1, published August 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.72%, the 93rd percentile. No source names a fixed version.