CVE-2026-19586 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
Unauthenticated attackers can execute arbitrary commands on Omada gateways if the OpenVPN Server feature is enabled, leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19586?
CVE-2026-19586 is a critical command injection vulnerability in TP-Link Systems Inc DR3150 v1, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
Weakness: CWE-78
Which versions are affected by CVE-2026-19586?
It affects 18 products.
Products include Tp-Link Dr3150 Firmware, Tp-Link Dr3220v-4g Firmware, Tp-Link Dr3650v-4g Firmware, Tp-Link Dr3650v Firmware, Tp-Link Er603wp-4g-Outdoor Firmware, Tp-Link Er605 Firmware and 12 more.
How do I fix CVE-2026-19586?
No fix has been published for CVE-2026-19586 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-19586 being exploited?
There is no known exploitation of CVE-2026-19586 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in TP-Link Systems Inc DR3150 v1
Sources
Also known as GHSA-32hp-8pjq-2c8g.