CVE-2026-19586
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.
Risk Assessment
The risk includes arbitrary command execution, potentially leading to full compromise of the affected device.
Recommendation
Immediately update Omada gateway firmware and restrict access to the OpenVPN service.
Other vulnerabilities in Omada gateways
See all- CVE-2025-7851Critical
An attacker may obtain a root shell on the underlying OS system under restricted conditions on Omada gateways. The vulnerability concerns gaining root privileges on the gateway's base system.
- CVE-2025-7850High
A command injection vulnerability in the web portal of Omada gateways can be exploited after administrator authentication. An attacker with admin credentials can execute arbitrary commands on the system.
Original NVD description (English source)
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS