Matt Graham

**Name of the Vulnerable Software and Affected Versions** Omada gateways (affected versions not specified) **Description** A pre-authentication OS command injection exists in Omada gateways configured as an OpenVPN Server. The issue stems from insufficient validation of client-supplied data during the OpenVPN connection establishment process. An unauthenticated remote attacker can provide specially crafted input to influence backend command execution logic, utilizing techniques such as awk injection. Successful exploitation requires the OpenVPN Server feature to be enabled and the VPN service to be reachable. This may allow arbitrary command execution, potentially leading to a full compromise of the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the OpenVPN Server feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TP-Link routers (affected versions not specified) **Description** Insufficient validation of externally supplied DHCP option data in the DHCP option processing logic allows an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges. This occurs when the device is in a factory-default or unconfigured state, where the attacker supplies crafted DHCP responses during device initialization or provisioning workflows. Successful exploitation can lead to full compromise of the device and unauthorized administrative control. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer C20 versions prior to V6 251031 TP-Link Archer AX53 version prior to V1 251215 **Description** A logic issue exists in the TDDP module of TP-Link Archer C20 v6.0 and Archer AX53 v1.0. An unauthenticated attacker on an adjacent network can execute administrative commands, including factory reset and device reboot, without credentials. This can lead to configuration loss and interruption of device availability. **Recommendations** Update TP-Link Archer C20 to version V6 251031 or later. Update TP-Link Archer AX53 to version V1 251215 or later.