CVE-2025-7850
HighCVSS 7.2Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A command injection vulnerability in the web portal of Omada gateways can be exploited after administrator authentication. An attacker with admin credentials can execute arbitrary commands on the system.
Risk Assessment
An actor with valid administrator credentials can take control of the gateway and run malicious commands, leading to full compromise of confidentiality, integrity, and availability of the device.
Recommendation
Update Omada gateway firmware to the latest patched version and restrict access to the administrative portal to trusted networks.
Other vulnerabilities in Omada gateways
See all- CVE-2026-19586Critical
A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.
- CVE-2025-7851Critical
An attacker may obtain a root shell on the underlying OS system under restricted conditions on Omada gateways. The vulnerability concerns gaining root privileges on the gateway's base system.
Original NVD description (English source)
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS