vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-19683

Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

HIGH
7.4
CVSS Score
Published: August 20, 2026 at 06:32 PM UTC
Updated: October 26, 2026 at 10:10 AM UTC
36 products affected across 1 vendorER7212PC FirmwareEr707-m2 FirmwareER706W 4G Firmware· also runs on 18 platforms

Using ER7212PC v2 by TP-Link Systems Inc.?

Get instant alerts when new vulnerabilities affect ER7212PC v2 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.4
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

DR3150 Firmware· TP-Link
95%
All versionsv < 1.0.1
Affected range stops below 1.0.1, so it looks safe — our inference, not a vendor statement
tp-link-dr3150 (same device)
DR3220V 4G Firmware· TP-Link
95%
All versionsv < 1.2.0
Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement
tp-link-dr3220v-4g (same device)
DR3650V 4G Firmware· TP-Link
95%
All versionsv < 1.2.0
Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement
tp-link-dr3650v-4g (same device)
DR3650V Firmware· TP-Link
95%
All versionsv < 1.2.0
Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement
tp-link-dr3650v (same device)
ER603WP 4G Outdoor Firmware· TP-Link
95%
All versionsv < 1.0.2
Affected range stops below 1.0.2, so it looks safe — our inference, not a vendor statement
tp-link-er603wp-4g-outdoor (same device)
ER605 Firmware· TP-Link
95%
All versionsv < 2.4.4
Affected range stops below 2.4.4, so it looks safe — our inference, not a vendor statement
tp-link-er605 (same device)
ER605W Firmware· TP-Link
95%
All versionsv < 2.0.4
Affected range stops below 2.0.4, so it looks safe — our inference, not a vendor statement
tp-link-er605w (same device)
Er701-5g Outdoor Firmware· TP-Link
95%
All versionsv < 1.0.3
Affected range stops below 1.0.3, so it looks safe — our inference, not a vendor statement
tp-link-er701-5g-outdoor (same device)
ER703WP 4G Outdoor Firmware· TP-Link
95%
All versionsv < 1.1.7
Affected range stops below 1.1.7, so it looks safe — our inference, not a vendor statement
tp-link-er703wp-4g-outdoor (same device)
ER706W 4G Firmware· TP-Link
95%
All versionsv < 1.2.6v < 2.1.11
Affected range stops below 1.2.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.1.11, so it looks safe — our inference, not a vendor statement
tp-link-er706w-4g (same device)

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

DR3150· TP-Link
95%
Affected range stops below 1.0.1 Build 20260722 Rel.16854, so it looks safe — our inference, not a vendor statement
DR3220v-4G· TP-Link
95%
Affected range stops below 1.2.0 Build 20260630 Rel.82652, so it looks safe — our inference, not a vendor statement
DR3650v· TP-Link
95%
Affected range stops below 1.2.0 Build 20260630 Rel.83311, so it looks safe — our inference, not a vendor statement
DR3650v-4G· TP-Link
95%
Affected range stops below 1.2.0 Build 20260630 Rel.83347, so it looks safe — our inference, not a vendor statement
ER603WP-4G-Outdoor· TP-Link
95%
Affected range stops below 1.0.2 Build 20260723 Rel.43271, so it looks safe — our inference, not a vendor statement
ER605· TP-Link
95%
Affected range stops below 2.4.4 Build 20260630 Rel.14398, so it looks safe — our inference, not a vendor statement
ER605W· TP-Link
95%
Affected range stops below 2.0.4 Build 20260723 Rel.43763, so it looks safe — our inference, not a vendor statement
ER701-5G-Outdoor· TP-Link
95%
Affected range stops below 1.0.3 Build 20260723 Rel.40931, so it looks safe — our inference, not a vendor statement
ER703WP-4G-Outdoor· TP-Link
95%
Affected range stops below 1.1.7 Build 20260723 Rel.41712, so it looks safe — our inference, not a vendor statement
ER706W· TP-Link
95%
Affected range stops below 1.2.11 Build 20260723 Rel.41567, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

PatchProduct
Source: cverecord
https://www.omadanetworks.com/en/support/download/
PatchProduct
Source: cverecord
https://www.omadanetworks.com/us/support/download/
Vendor Advisory
Source: cverecord
https://www.tp-link.com/us/support/faq/5256/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.4HIGH[email protected]
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-319

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card