1. Home
  2. CVE Database
  3. CVE-2026-1668
CRITICAL · 9.8

CVE-2026-1668

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific condit...

Vulnerability Description

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Tp-LinkOmada Sg2005P-Pd Firmware>= 1.0.0, < 1.0.19
Tp-LinkOmada Sg2005P-Pd-
Tp-LinkOmada Sg2008 Firmware>= 4.20.0, < 4.20.17
Tp-LinkOmada Sg2008-
Tp-LinkOmada Sg2008P Firmware>= 3.20.0, < 3.20.17
Tp-LinkOmada Sg2008P-
Tp-LinkOmada Sg2016P Firmware>= 1.20.0, < 1.20.17
Tp-LinkOmada Sg2016P-
Tp-LinkOmada Sg2210Mp Firmware>= 4.20.0, < 4.20.18
Tp-LinkOmada Sg2210Mp-
Tp-LinkOmada Sg2210P Firmware>= 5.20.0, < 5.20.18
Tp-LinkOmada Sg2210P-
Tp-LinkOmada Sg2210Xmp-M2 Firmware>= 1.0.0, < 1.0.19
Tp-LinkOmada Sg2210Xmp-M2-
Tp-LinkOmada Sg2218 Firmware>= 1.20.0, < 1.20.17
Tp-LinkOmada Sg2218-
Tp-LinkOmada Sg2218P Firmware>= 1.20.0, < 1.20.17
Tp-LinkOmada Sg2218P-
Tp-LinkOmada Sg2428Lp Firmware>= 1.0.0, < 1.0.13
Tp-LinkOmada Sg2428Lp-

Related Weaknesses (CWE)

CWE-20CWE-787

References

FAQ

What is CVE-2026-1668?

CVE-2026-1668 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific condit...

How severe is CVE-2026-1668?

CVE-2026-1668 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-1668?

Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Omada Sg2005P-Pd Firmware, Tp-Link Omada Sg2005P-Pd, Tp-Link Omada Sg2008 Firmware, Tp-Link Omada Sg2008, Tp-Link Omada Sg2008P Firmware.