TP-Link
Number 51 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
366
Critical
13
High
213
Known Exploited
5
Exploit available
9
Visible in Bangladesh
19
Services seen by internet scanning
Network, no login needed
11.4%
Of 342 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 184 | 1 | 118 | 63 | 2 | 0 |
| 2025 | 32 | 3 | 16 | 12 | 1 | 0 |
| 2024 | 73 | 4 | 42 | 26 | 1 | 0 |
| 2023 | 50 | 2 | 22 | 7 | 0 | 19 |
| 2022 | 8 | 2 | 4 | 2 | 0 | 0 |
| 2021 | 3 | 0 | 2 | 0 | 0 | 1 |
| 2020 | 11 | 1 | 8 | 2 | 0 | 0 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2018 | 4 | 0 | 0 | 0 | 0 | 4 |
| 2017 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2015 | 1 | 0 | 1 | 0 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| tl-wr886n_firmware | 13 | 13 |
| AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | 12 | 12 |
| Archer BE230 v1.2 | 11 | 9 |
| Archer AX53 v1.0 | 10 | 10 |
| Archer A7 | 9 | 7 |
| ER7206 Omada Gigabit VPN Router | 9 | 9 |
| Omada ER605 | 7 | 5 |
| Omada Gateways | 7 | 2 |
| RE305 v3 | 6 | 1 |
| TL-WR940N | 6 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Command Injection | 75 | 70 |
| Memory Corruption | 60 | 47 |
| Stack-based Buffer Overflow | 29 | 21 |
| Authentication Issues | 26 | 18 |
| Stack-based buffer overflow | 17 | 13 |
| Improper Input Validation | 15 | 10 |
| Cross-Site Scripting | 7 | 2 |
| Use of hard-coded cryptographic key | 6 | 2 |
| Path Traversal | 5 | 1 |
| Denial of Service | 4 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2025-9377 | Authenticated RCE via Parental Control command injection | High | 41.3% | |
| CVE-2023-50224 | TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability | Medium | 20.0% | |
| CVE-2023-33538 | TP-Link Multiple Routers Command Injection Vulnerability | High | 41.6% | |
| CVE-2020-24363 | TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability | High | 22.2% | |
| CVE-2015-3035 | TP-Link Multiple Archer Devices Directory Traversal Vulnerability | High | 83.9% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-109683 | UPnP Newline Injection Vulnerability in TP-Link Archer BE805 | Medium | 0.3% | |
| CVE-2026-118865 | Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component | High | 0.9% | |
| CVE-2026-105822 | Server-Side Request Forgery in Tapo Cloud MQTT Proxy | High | 0.2% | |
| CVE-2026-105821 | Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy | High | 0.2% | |
| CVE-2026-102816 | Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 | Medium | 0.2% | |
| CVE-2026-102815 | Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305 | Medium | 0.6% | |
| CVE-2026-102814 | Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305 | High | 0.4% | |
| CVE-2026-102813 | Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 | Medium | 0.2% | |
| CVE-2026-102812 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 | Medium | 0.1% | |
| CVE-2026-89052 | Hardcoded AES encryption key in Archer C6 | Medium | 0.2% |