CVE-2026-1668: TP-Link Omada Sg2210mp Firmware remote code execution (CVSS 9.8)

Description

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

TP-Link Omada Sg2005p-pd Firmware≥ 1.0.0 < 1.0.19

TP-Link Omada Sg2008 Firmware≥ 4.20.0 < 4.20.17 · ≥ 4.30.0 < 4.30.1

TP-Link Omada Sg2008p Firmware≥ 3.20.0 < 3.20.17 · ≥ 3.30.0 < 3.30.1

TP-Link Omada Sg2016p Firmware≥ 1.20.0 < 1.20.17 · ≥ 1.30.0 < 1.30.1

TP-Link Omada Sg2210mp Firmware≥ 4.20.0 < 4.20.18 · ≥ 5.0.0 < 5.0.15 · ≥ 5.20.0 < 5.20.1

TP-Link Omada Sg2210p Firmware≥ 5.20.0 < 5.20.18 · ≥ 5.30.0 < 5.30.1

TP-Link Omada Sg2210xmp-m2 Firmware≥ 1.0.0 < 1.0.19

TP-Link Omada Sg2218 Firmware≥ 1.20.0 < 1.20.17 · ≥ 1.30.0 < 1.30.1

TP-Link Omada Sg2218p Firmware≥ 1.20.0 < 1.20.17 · ≥ 2.0.0 < 2.0.14 · ≥ 2.20.0 < 2.20.2

TP-Link Omada Sg2428lp Firmware≥ 1.0.0 < 1.0.13

TP-Link Omada Sg2428p Firmware≥ 5.20.0 < 5.20.20 · ≥ 5.30.0 < 5.30.16

TP-Link Omada Sg2452lp Firmware≥ 1.0.0 < 1.0.13

TP-Link Omada Sg3210 Firmware≥ 3.20.0 < 3.20.17 · ≥ 3.30.0 < 3.30.1

TP-Link Omada Sg3210xhp-m2 Firmware≥ 3.0.0 < 3.0.21

TP-Link Omada Sg3210x-m2 Firmware≥ 1.20.0 < 1.20.1

TP-Link Omada Sg3218xp-m2 Firmware≥ 1.0.0 < 1.0.19

TP-Link Omada Sg3428 Firmware≥ 2.30.0 < 2.30.16 · ≥ 2.40.0 < 2.40.1

TP-Link Omada Sg3428mp Firmware≥ 6.20.0 < 6.20.20 · ≥ 6.30.0 < 6.30.1

TP-Link Omada Sg3428xf Firmware≥ 1.20.0 < 1.20.16 · ≥ 1.30.0 < 1.30.1

TP-Link Omada Sg3428x Firmware≥ 1.30.0 < 1.30.17 · ≥ 1.40.0 < 1.40.1

TP-Link Omada Sg3428x-m2 Firmware≥ 1.20.0 < 1.20.18

TP-Link Omada Sg3428xmp Firmware≥ 3.20.0 < 3.20.21 · ≥ 3.30.0 < 3.30.1

TP-Link Omada Sg3428xmpp Firmware≥ 1.0.0 < 1.0.16 · ≥ 1.20.0 < 1.20.1

TP-Link Omada Sg3428xpp-m2 Firmware≥ 1.20.0 < 1.20.19

Remediation

Fixed in

TP-Link Omada Sg2005p-pd Firmware≥ 1.0.19

TP-Link Omada Sg2008 Firmware≥ 4.20.17

TP-Link Omada Sg2008p Firmware≥ 3.20.17

TP-Link Omada Sg2016p Firmware≥ 1.20.17

TP-Link Omada Sg2210mp Firmware≥ 4.20.18

TP-Link Omada Sg2210p Firmware≥ 5.20.18

TP-Link Omada Sg2210xmp-m2 Firmware≥ 1.0.19

TP-Link Omada Sg2218 Firmware≥ 1.20.17

TP-Link Omada Sg2218p Firmware≥ 1.20.17

TP-Link Omada Sg2428lp Firmware≥ 1.0.13

Patch & vendor advisories

https://support.omadanetworks.com/us/document/118794/

References

https://support.omadanetworks.com/au/download/firmware/Product
https://support.omadanetworks.com/en/download/firmware/Product
https://support.omadanetworks.com/us/document/118794/Vendor Advisory
https://support.omadanetworks.com/us/product/Product

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-1668 being actively exploited?

CVE-2026-1668 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.02%.

How severe is CVE-2026-1668?

CVE-2026-1668 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.02% probability of exploitation.

Which products are affected by CVE-2026-1668?

Affected products include TP-Link Omada Sg2005p-pd Firmware, TP-Link Omada Sg2008 Firmware, TP-Link Omada Sg2008p Firmware, TP-Link Omada Sg2016p Firmware, TP-Link Omada Sg2210mp Firmware, and 19 more.

How do I fix CVE-2026-1668?

Upgrade affected software to a fixed version, for example TP-Link Omada Sg2005p-pd Firmware 1.0.19, TP-Link Omada Sg2008 Firmware 4.20.17, TP-Link Omada Sg2008p Firmware 3.20.17 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-1668 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo