TP-LINK WARNS OF CRITICAL COMMAND INJECTION FLAW IN OMADA GATEWAYS

Summary from the TLDR InfoSec newsletter

TP-Link has issued a warning about two command injection vulnerabilities in Omada gateway devices that could allow attackers to execute arbitrary OS commands. One of the flaws has a critical severity rating (CVSS 9.3) and can be exploited by unauthenticated attackers, while the second requires access to the web management interface. TP-Link also disclosed two additional vulnerabilities in a separate bulletin that could allow command injection and root access.