CVE-2026-19683

What it is

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.  Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-20 19:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 10:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-20 19:16 UTC

Last modified

2026-10-26 10:10 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-319 · Cleartext transmission

Record status

Analyzed

Affected

• TP-Link er7212pc Firmware < 2.4.3
• TP-Link er605 Firmware < 2.4.4
• TP-Link er7206 Firmware < 2.3.5
• TP-Link er7406 Firmware < 1.3.4
• TP-Link er707-m2 Firmware < 1.4.4
• TP-Link er7412-m2 Firmware < 1.2.0
• TP-Link er8411 Firmware < 1.4.1
• TP-Link er706w Firmware < 1.2.11

Attack profile CVSS 4.0 · 6.3

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None