CVE-2026-1668 json
Input Validation Vulnerability on Multiple Omada Switches
published 2026-03-13 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-12049
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
Patch / fix
- TP-Link Systems Inc. SG2008P 3.2x 3.20.17 Build 20260121 Rel.53429
- TP-Link Systems Inc. SG2008P 3.3x 3.30.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SX3016F 1.3x 1.30.1 Build 20260129 Rel.8831
- TP-Link Systems Inc. SX3016F 1.2x 1.20.16 Build 20260121 Rel.57953
- TP-Link Systems Inc. SG3428 2.4x 2.40.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG3428XMP 3.3x 3.30.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG3428X 1.4x 1.40.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG3428XF 1.3x 1.30.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG3452P 3.4x 3.40.1 Build 20260128 Rel.7041
- TP-Link Systems Inc. SG3428MP 6.3x 6.30.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG2218P 2.2x 2.20.2 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG2016P 1.3x 1.30.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG3452XP 2.3x 2.30.1 Build 20260128 Rel.8721
- TP-Link Systems Inc. SG3428XMPP 1.2x 1.20.1 Build 20260127 Rel.39545
- TP-Link Systems Inc. SG3452X 1.3x 1.30.1 Build 20260128 Rel.8721
- TP-Link Systems Inc. SG2008 4.3x 4.30.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG3210 3.3x 3.30.1 Build 20260206 Rel.33103
- TP-Link Systems Inc. SG2210MP 5.2x 5.20.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG2210P 5.3x 5.30.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG2218 1.3x 1.30.1 Build 20260127 Rel.32017
- TP-Link Systems Inc. SG3452 1.3x 1.30.1 Build 20260128 Rel.7041
- TP-Link Systems Inc. SG3210X-M2 1.2x 1.20.1 Build 20260129 Rel.13605
- TP-Link Systems Inc. SG2210XMP-M2 1.x 1.0.19 Build 20260121 Rel.53314
- TP-Link Systems Inc. SG2008 4.2x 4.20.17 Build 20260121 Rel.53429
- TP-Link Systems Inc. SG2218P 1.2x 1.20.17 Build 20260121 Rel.53429
- TP-Link Systems Inc. SG3210 3.2x 3.20.17 Build 20260121 Rel.53429
- TP-Link Systems Inc. SG3428X-M2 1.2x 1.20.18 Build 20260121 Rel.54271
- TP-Link Systems Inc. SX3832MPP 1.x 1.0.11 Build 20260121 Rel.56907
- TP-Link Systems Inc. SG2218 1.2x 1.20.17 Build 20260121 Rel.53429
- TP-Link Systems Inc. SX3832 1.x 1.0.12 Build 20260121 Rel.56907
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- TP-Link Systems Inc. SG2008P 3.2x
- TP-Link Systems Inc. SG2008P 3.3x
- TP-Link Systems Inc. SX3016F 1.3x
- TP-Link Systems Inc. SX3016F 1.2x
- TP-Link Systems Inc. SG3428 2.4x
- TP-Link Systems Inc. SG3428XMP 3.3x
- TP-Link Systems Inc. SG3428X 1.4x
- TP-Link Systems Inc. SG3428XF 1.3x
- TP-Link Systems Inc. SG3452P 3.4x
- TP-Link Systems Inc. SG3428MP 6.3x
- TP-Link Systems Inc. SG2218P 2.2x
- TP-Link Systems Inc. SG2016P 1.3x
- TP-Link Systems Inc. SG3452XP 2.3x
- TP-Link Systems Inc. SG3428XMPP 1.2x
- TP-Link Systems Inc. SG3452X 1.3x
- TP-Link Systems Inc. SG2008 4.3x
- TP-Link Systems Inc. SG3210 3.3x
- TP-Link Systems Inc. SG2210MP 5.2x
- TP-Link Systems Inc. SG2210P 5.3x
- TP-Link Systems Inc. SG2218 1.3x
- TP-Link Systems Inc. SG3452 1.3x
- TP-Link Systems Inc. SG3210X-M2 1.2x
- TP-Link Systems Inc. SG2210XMP-M2 1.x
- TP-Link Systems Inc. SG2008 4.2x
- TP-Link Systems Inc. SG2218P 1.2x
- TP-Link Systems Inc. SG3210 3.2x
- TP-Link Systems Inc. SG3428X-M2 1.2x
- TP-Link Systems Inc. SX3832MPP 1.x
- TP-Link Systems Inc. SG2218 1.2x
- TP-Link Systems Inc. SX3832 1.x
- TP-Link Systems Inc. SG2428LP 1.x
- TP-Link Systems Inc. SL2428P 6.2x
- TP-Link Systems Inc. SG3218XP-M2 1.x
- TP-Link Systems Inc. SG3210XHP-M2 3.x
- TP-Link Systems Inc. SG2218P 2.x
- TP-Link Systems Inc. SG3210X-M2 1.x
- TP-Link Systems Inc. SG2428P 5.3x
- TP-Link Systems Inc. SG2210MP 4.2x
- TP-Link Systems Inc. SG3452P 3.3x
- TP-Link Systems Inc. SG3452 1.2x
- TP-Link Systems Inc. SG2452LP 1.x
- TP-Link Systems Inc. SX3032F 1.x
- TP-Link Systems Inc. SG3452X 1.2x
- TP-Link Systems Inc. SG3452XMPP 1.x
- TP-Link Systems Inc. SG3428XPP-M2 1.2x
- TP-Link Systems Inc. TL-SG3452P 3.0
- TP-Link Systems Inc. SG2428P 5.2x
- TP-Link Systems Inc. SG2210MP 5.x
- TP-Link Systems Inc. SG2005P-PD 1.x
- TP-Link Systems Inc. SG2016P 1.2x
Classification
References
-
support.omadanetworks.com
/us/product/
patch, product
-
support.omadanetworks.com
/au/download/firmware/
patch, product
-
support.omadanetworks.com
/en/download/firmware/
patch, product
-
support.omadanetworks.com
/us/document/118794/
vendor-advisory
Sources
- CVE List CVE-2026-1668
- NVD CVE-2026-1668
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.