CVE-2026-19586
Received Received - Intake

Pre-authentication OS Command Injection in Omada Gateway OpenVPN Server

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: TPLink

Description
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.  Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-19586
EUVD
EUVD-2026-63544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omada gateway *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication OS command injection vulnerability in Omada gateways when configured as OpenVPN Servers. It occurs due to insufficient validation of client-supplied data during OpenVPN connection setup. An attacker can send specially crafted input to execute arbitrary commands on the device before authentication is required.

Detection Guidance

Detecting this vulnerability requires checking if Omada gateways have the OpenVPN Server feature enabled and if the service is exposed to the network. Inspect network traffic for OpenVPN connection attempts on the default port (1194/TCP by default). Use commands like 'netstat -tulnp | grep 1194' or 'ss -tulnp | grep 1194' to check if the OpenVPN service is listening. Review gateway logs for unusual connection patterns or failed OpenVPN handshakes.

Impact Analysis

Exploitation may allow an unauthenticated remote attacker to gain full control of the affected Omada gateway. This could lead to unauthorized access, data theft, network compromise, or disruption of VPN services if the OpenVPN Server feature is enabled and exposed to the attacker.

Compliance Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected devices, potentially leading to full system compromise. Such unauthorized access could result in unauthorized data access, modification, or exfiltration, which directly conflicts with compliance requirements under GDPR (data protection) and HIPAA (patient data confidentiality).

Mitigation Strategies

Disable the OpenVPN Server feature on Omada gateways if not in use. If the feature is required, restrict access to the VPN service using firewall rules to allow connections only from trusted IP addresses. Update the gateway firmware to the latest version as soon as patches are available. Monitor network traffic for suspicious OpenVPN connection attempts and block offending IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart