CVE-2026-1668Input Validation Vulnerability on Multiple Omada Switches
- 7.7HighCVSS base score
- 1.0%Exploitation in 30 daysEPSS · top 35% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
Timeline
ID reserved
By TPLink
- 43 days later
· 43 days later
Published
- 8 months later
· 8 months later
EPSS rose above 1%
0.96% → 1.0%
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TPLinkCNA (assigner) | 4.0 | High7.7 | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Analyzed | 4.0 | High7.7 | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 1.0% · top 35% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.
Affected products
TP-Link Systems Inc. · SG2008P 3.2x
- affected < 3.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2008P 3.3x
- affected < 3.30.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SX3016F 1.3x
- affected < 1.30.1 Build 20260129 Rel.8831
TP-Link Systems Inc. · SX3016F 1.2x
- affected < 1.20.16 Build 20260121 Rel.57953
TP-Link Systems Inc. · SG3428 2.4x
- affected < 2.40.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG3428XMP 3.3x
- affected < 3.30.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG3428X 1.4x
- affected < 1.40.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG3428XF 1.3x
- affected < 1.30.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG3452P 3.4x
- affected < 3.40.1 Build 20260128 Rel.7041
TP-Link Systems Inc. · SG3428MP 6.3x
- affected < 6.30.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG2218P 2.2x
- affected < 2.20.2 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG2016P 1.3x
- affected < 1.30.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG3452XP 2.3x
- affected < 2.30.1 Build 20260128 Rel.8721
TP-Link Systems Inc. · SG3428XMPP 1.2x
- affected < 1.20.1 Build 20260127 Rel.39545
TP-Link Systems Inc. · SG3452X 1.3x
- affected < 1.30.1 Build 20260128 Rel.8721
TP-Link Systems Inc. · SG2008 4.3x
- affected < 4.30.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG3210 3.3x
- affected < 3.30.1 Build 20260206 Rel.33103
TP-Link Systems Inc. · SG2210MP 5.2x
- affected < 5.20.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG2210P 5.3x
- affected < 5.30.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG2218 1.3x
- affected < 1.30.1 Build 20260127 Rel.32017
TP-Link Systems Inc. · SG3452 1.3x
- affected < 1.30.1 Build 20260128 Rel.7041
TP-Link Systems Inc. · SG3210X-M2 1.2x
- affected < 1.20.1 Build 20260129 Rel.13605
TP-Link Systems Inc. · SG2210XMP-M2 1.x
- affected < 1.0.19 Build 20260121 Rel.53314
TP-Link Systems Inc. · SG2008 4.2x
- affected < 4.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2218P 1.2x
- affected < 1.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3210 3.2x
- affected < 3.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3428X-M2 1.2x
- affected < 1.20.18 Build 20260121 Rel.54271
TP-Link Systems Inc. · SX3832MPP 1.x
- affected < 1.0.11 Build 20260121 Rel.56907
TP-Link Systems Inc. · SG2218 1.2x
- affected < 1.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SX3832 1.x
- affected < 1.0.12 Build 20260121 Rel.56907
TP-Link Systems Inc. · SG2428LP 1.x
- affected < 1.0.15 Build 20260121 Rel.53429
TP-Link Systems Inc. · SL2428P 6.2x
- affected < 6.20.18 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3218XP-M2 1.x
- affected < 1.0.19 Build 20260121 Rel.53314
TP-Link Systems Inc. · SG3210XHP-M2 3.x
- affected < 3.0.21 Build 20260121 Rel.53314
TP-Link Systems Inc. · SG2218P 2.x
- affected < 2.0.14 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3210X-M2 1.x
- affected < 1.0.19 Build 20260121 Rel.53314
TP-Link Systems Inc. · SG2428P 5.3x
- affected < 5.30.16 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2210MP 4.2x
- affected < 4.20.18 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3452P 3.3x
- affected < 3.30.17 Build 20260121 Rel.54132
TP-Link Systems Inc. · SG3452 1.2x
- affected < 1.20.17 Build 20260121 Rel.54132
TP-Link Systems Inc. · SG2452LP 1.x
- affected < 1.0.13 Build 20260121 Rel.54132
TP-Link Systems Inc. · SX3032F 1.x
- affected < 1.0.15 Build 20260121 Rel.56907
TP-Link Systems Inc. · SG3452X 1.2x
- affected < 1.20.18 Build 20260121 Rel.55833
TP-Link Systems Inc. · SG3452XMPP 1.x
- affected < 1.0.15 Build 20260121 Rel.55833
TP-Link Systems Inc. · SG3428XPP-M2 1.2x
- affected < 1.20.19 Build 20260121 Rel.54271
TP-Link Systems Inc. · TL-SG3452P 3.0
- affected < 3.0.22 Build 20260121 Rel.54132
TP-Link Systems Inc. · SG2428P 5.2x
- affected < 5.20.20 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2210MP 5.x
- affected < 5.0.15 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2005P-PD 1.x
- affected < 1.0.19 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2016P 1.2x
- affected < 1.20.17 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG3452XP 2.2x
- affected < 2.20.20 Build 20260121 Rel.55833
TP-Link Systems Inc. · SG3428XMP 3.2x
- affected < 3.20.21 Build 20260113 Rel.67732
TP-Link Systems Inc. · SG3428X 1.3x
- affected < 1.30.17 Build 20260113 Rel.67732
TP-Link Systems Inc. · SG3428XF 1.2x
- affected < 1.20.16 Build 20260113 Rel.67732
TP-Link Systems Inc. · SG3428MP 6.2x
- affected < 6.20.20 Build 20260113 Rel.67732
TP-Link Systems Inc. · TL-SG3428MP 5.x
- affected < 5.0.25 Build 20260113 Rel.67732
TP-Link Systems Inc. · SG3428 2.3x
- affected < 2.30.16 Build 20260113 Rel.67732
TP-Link Systems Inc. · SG3428XMPP 1.x
- affected < 1.0.16 Build 20260113 Rel.67732
TP-Link Systems Inc. · TL-SG2428P 4.x
- affected < 4.0.26 Build 20260121 Rel.53429
TP-Link Systems Inc. · SG2210P 5.2x
- affected < 5.20.18 Build 20260121 Rel.53429
TP-Link Systems Inc. · SX3008F 1.2x
- affected 0
TP-Link Systems Inc. · SX3206HPP 1.20
- affected 0
References
References4
- https://support.omadanetworks.com/us/product/ (opens in a new tab)patch
- https://support.omadanetworks.com/au/download/firmware/ (opens in a new tab)patch
- https://support.omadanetworks.com/en/download/firmware/ (opens in a new tab)patch
- https://support.omadanetworks.com/us/document/118794/ (opens in a new tab)vendor-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-12049 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-1668)Record last updated .