CVE record · CVE-2026-19683

Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

CVSS 6.3 MediumEPSS 0.0034 · 28th percentile

Published by the CVE Program (CNA: TPLink) at 20 Aug 2026, 18:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
TP-Link Systems Inc.	ER7212PC v2	affected before 2.4.3 Build 20260722 Rel.40250 custom Other versions: unaffected
TP-Link Systems Inc.	ER605 v2	affected before 2.4.4 Build 20260630 Rel.14398 custom Other versions: unaffected
TP-Link Systems Inc.	ER7206 v2	affected before 2.3.5 Build 20260625 Rel.43136 custom Other versions: unaffected
TP-Link Systems Inc	ER7406 v1	affected before 1.3.4 Build 20260625 Rel.43136 custom Other versions: unaffected
TP-Link Systems Inc.	ER707-M2 v1	affected before 1.4.4 Build 20260625 Rel.43063 custom Other versions: unaffected
TP-Link Systems Inc	ER7412-M2 v1	affected before 1.2.0 Build 20260630 Rel.82947 custom Other versions: unaffected
TP-Link Systems Inc.	ER8411 v1	affected before 1.4.1 Build 20260708 Rel.64832 custom Other versions: unaffected
TP-Link Systems Inc.	ER706W v1	affected before 1.2.11 Build 20260723 Rel.41567 custom Other versions: unaffected
TP-Link Systems Inc.	v1	affected before 1.2.6 Build 20260723 Rel.41321 custom Other versions: unaffected
TP-Link Systems Inc.	ER706W-4G v2	affected before 2.1.11 Build 20260723 Rel.41624 custom Other versions: unaffected
TP-Link Systems Inc.	ER706WP-4G v1	affected before 1.1.11 Build 20260723 Rel.41624 custom Other versions: unaffected
TP-Link Systems Inc.	ER703WP-4G-Outdoor v1	affected before 1.1.7 Build 20260723 Rel.41712 custom Other versions: unaffected
TP-Link Systems Inc.	DR3220v-4G v1	affected before 1.2.0 Build 20260630 Rel.82652 custom Other versions: unaffected
TP-Link Systems Inc.	DR3650v v1	affected before 1.2.0 Build 20260630 Rel.83311 custom Other versions: unaffected
TP-Link Systems Inc.	DR3650v-4G v1	affected before 1.2.0 Build 20260630 Rel.83347 custom Other versions: unaffected
TP-Link Systems Inc.	ER603WP-4G-Outdoor v1	affected before 1.0.2 Build 20260723 Rel.43271 custom Other versions: unaffected
TP-Link Systems Inc.	DR3150 v1	affected before 1.0.1 Build 20260722 Rel.16854 custom Other versions: unaffected
TP-Link Systems Inc.	ER701-5G-Outdoor v1	affected before 1.0.3 Build 20260723 Rel.40931 custom Other versions: unaffected
TP-Link Systems Inc.	ER605W v2	affected before 2.0.4 Build 20260723 Rel.43763 custom Other versions: unaffected

Identifiers: CVE-2026-19683
CNA: TPLink
Weakness (CWE): CWE-319
Tags: TP-Link Systems Inc. ER7212PC v2
TP-Link Systems Inc. ER605 v2
TP-Link Systems Inc. ER7206 v2
TP-Link Systems Inc ER7406 v1
TP-Link Systems Inc. ER707-M2 v1
TP-Link Systems Inc ER7412-M2 v1
TP-Link Systems Inc. ER8411 v1
TP-Link Systems Inc. ER706W v1
Weak cryptography or TLS
Published: 20 Aug 2026
Updated: 20 Aug 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.3	Medium	4.0	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	CNA (TPLink)

CISA KEV Not listed.
EPSS 0.0034, the 28th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 20 Aug 2026. New records show when each source confirmed them.

Sources

References from the CNA

www.omadanetworks.com/en/support/download/ patch
www.omadanetworks.com/us/support/download/ patch
www.tp-link.com/us/support/faq/5256/ vendor-advisory

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.