Vulnerability details

CVE-2026-1668

TP-Link Systems SG2005P-PD 1.xTP-Link Systems SG2008TP-Link Systems SG2008PTP-Link Systems SG2016PTP-Link Systems SG2210MPTP-Link Systems SG2210MP 5.x

Input Validation Vulnerability on Multiple Omada Switches

CVSS 4.0

7.7High

Official description

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

CVSS scores

Score	Version	Source	Vector
7.7High	4.0	CVEProject cvelistV5 (CNA) (TPLink)	`CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
TP-Link Systems Inc.	SG2005P-PD 1.x	v < 1.0.19 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2008 4.2x	v < 4.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2008 4.3x	v < 4.30.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2008P 3.2x	v < 3.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2008P 3.3x	v < 3.30.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2016P 1.2x	v < 1.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2016P 1.3x	v < 1.30.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210MP 4.2x	v < 4.20.18 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210MP 5.2x	v < 5.20.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210MP 5.x	v < 5.0.15 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210P 5.2x	v < 5.20.18 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210P 5.3x	v < 5.30.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2210XMP-M2 1.x	v < 1.0.19 Build 20260121 Rel.53314	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2218 1.2x	v < 1.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2218 1.3x	v < 1.30.1 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2218P 1.2x	v < 1.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2218P 2.2x	v < 2.20.2 Build 20260127 Rel.32017	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2218P 2.x	v < 2.0.14 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2428LP 1.x	v < 1.0.15 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2428P 5.2x	v < 5.20.20 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2428P 5.3x	v < 5.30.16 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG2452LP 1.x	v < 1.0.13 Build 20260121 Rel.54132	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3210 3.2x	v < 3.20.17 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3210 3.3x	v < 3.30.1 Build 20260206 Rel.33103	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3210X-M2 1.2x	v < 1.20.1 Build 20260129 Rel.13605	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3210X-M2 1.x	v < 1.0.19 Build 20260121 Rel.53314	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3210XHP-M2 3.x	v < 3.0.21 Build 20260121 Rel.53314	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3218XP-M2 1.x	v < 1.0.19 Build 20260121 Rel.53314	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428 2.3x	v < 2.30.16 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428 2.4x	v < 2.40.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428MP 6.2x	v < 6.20.20 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428MP 6.3x	v < 6.30.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428X 1.3x	v < 1.30.17 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428X 1.4x	v < 1.40.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428X-M2 1.2x	v < 1.20.18 Build 20260121 Rel.54271	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XF 1.2x	v < 1.20.16 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XF 1.3x	v < 1.30.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XMP 3.2x	v < 3.20.21 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XMP 3.3x	v < 3.30.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XMPP 1.2x	v < 1.20.1 Build 20260127 Rel.39545	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XMPP 1.x	v < 1.0.16 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3428XPP-M2 1.2x	v < 1.20.19 Build 20260121 Rel.54271	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452 1.2x	v < 1.20.17 Build 20260121 Rel.54132	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452 1.3x	v < 1.30.1 Build 20260128 Rel.7041	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452P 3.3x	v < 3.30.17 Build 20260121 Rel.54132	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452P 3.4x	v < 3.40.1 Build 20260128 Rel.7041	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452X 1.2x	v < 1.20.18 Build 20260121 Rel.55833	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452X 1.3x	v < 1.30.1 Build 20260128 Rel.8721	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452XMPP 1.x	v < 1.0.15 Build 20260121 Rel.55833	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452XP 2.2x	v < 2.20.20 Build 20260121 Rel.55833	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SG3452XP 2.3x	v < 2.30.1 Build 20260128 Rel.8721	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SL2428P 6.2x	v < 6.20.18 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3008F 1.2x	All	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3016F 1.2x	v < 1.20.16 Build 20260121 Rel.57953	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3016F 1.3x	v < 1.30.1 Build 20260129 Rel.8831	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3032F 1.x	v < 1.0.15 Build 20260121 Rel.56907	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3206HPP 1.20	All	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3832 1.x	v < 1.0.12 Build 20260121 Rel.56907	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	SX3832MPP 1.x	v < 1.0.11 Build 20260121 Rel.56907	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	TL-SG2428P 4.x	v < 4.0.26 Build 20260121 Rel.53429	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	TL-SG3428MP 5.x	v < 5.0.25 Build 20260113 Rel.67732	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	TL-SG3452P 3.0	v < 3.0.22 Build 20260121 Rel.54132	CVEProject cvelistV5 (CNA)

References and advisories

https://support.omadanetworks.com/us/product/ patch
https://support.omadanetworks.com/au/download/firmware/ patch
https://support.omadanetworks.com/en/download/firmware/ patch
https://support.omadanetworks.com/us/document/118794/ vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-13
Last updated: 2026-03-13
State: Published
Assigner (CNA): TPLink

Exploit prediction (EPSS)

1.04%

Probability of exploitation in 30 days

64.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-20
Improper Input Validation