CVE-2025-7851 is a critical vulnerability affecting TP-Link Omada gateways, allowing an unauthenticated attacker to gain root shell access on the underlying operating system under specific conditions. With a CVSS score of 9.8, this flaw presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While no public exploit code or Metasploit modules are currently available, the vulnerability is reportedly being actively exploited in the wild and has garnered significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.5CPE matchmatch criteria | cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:* | ||
1.2.5CPE matchmatch criteria | cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:* | ||
< 1.0.3CPE matchmatch criteria | cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:* | ||
1.0.3CPE matchmatch criteria | cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:* | ||
< 1.1.10CPE matchmatch criteria | cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.