TP-Link OMADA ER605 Firmware 2.2.2 Build 20231017
Approved changes feed: RSS · Atom
cpe:2.3:o:tp-link:omada_er605_firmware:2.2.2:build_20231017:*:*:*:*:*:*
part: o version: 2.2.2 update: build_20231017
| Vendor | Tp Link (0b2e1553-ac8b-5981-a60b-ca6c27ee3a6e) |
|---|---|
| Product | Omada Er605 Firmware (dfe422d8-48f5-555b-bee4-d351fca73909) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-5244 |
vulnerable | 2026-06-08 06:56:15.314938 |
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability
MEDIUM (5)
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.
The specific flaw exists within the cmxddnsd executable. The issue results from reliance on obscurity to secure network data. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22439.
Published: 2024-05-23T21:56:08.846Z
Updated: 2024-08-01T21:03:11.048Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5243 |
vulnerable | 2026-06-08 06:56:15.314277 |
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability
HIGH (7.5)
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.
The specific flaw exists within the handling of DNS names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22523.
Published: 2024-05-23T21:56:04.395Z
Updated: 2024-08-01T21:03:11.130Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5242 |
vulnerable | 2026-06-08 06:56:15.313462 |
TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability
HIGH (7.5)
TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.
The specific flaw exists within the handling of DDNS error codes. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22522.
Published: 2024-05-23T21:55:59.756Z
Updated: 2024-08-01T21:03:11.096Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5228 |
vulnerable | 2026-06-08 06:56:15.293996 |
TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
HIGH (7.5)
TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.
The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22383.
Published: 2024-05-23T21:55:55.391Z
Updated: 2024-08-01T21:03:11.112Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5227 |
vulnerable | 2026-06-08 06:56:15.291739 |
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability
HIGH (7.5)
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication.
The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22446.
Published: 2024-05-23T21:55:48.347Z
Updated: 2024-09-03T16:05:33.661Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.