CVE-2025-7851
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An attacker may obtain a root shell on the underlying OS system under restricted conditions on Omada gateways. The vulnerability concerns gaining root privileges on the gateway's base system.
Risk Assessment
Obtaining a root shell on an Omada gateway can give an attacker full control over the device and network traffic.
Recommendation
Apply vendor-provided Omada gateway firmware updates and restrict administrative access to the devices.
Other vulnerabilities in Omada gateways
See all- CVE-2026-19586Critical
A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.
- CVE-2025-7850High
A command injection vulnerability in the web portal of Omada gateways can be exploited after administrator authentication. An attacker with admin credentials can execute arbitrary commands on the system.
Original NVD description (English source)
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS