NetSight
IP …
critical9.8

CVE-2026-1668

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing…

Impact

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

Affected products

VendorProductAffected versions
Tp-LinkOmada Sg2005p-Pd Firmware
from 1.0.0 before 1.0.19
Tp-LinkOmada Sg2008 Firmware
from 4.20.0 before 4.20.17
from 4.30.0 before 4.30.1
Tp-LinkOmada Sg2008p Firmware
from 3.20.0 before 3.20.17
from 3.30.0 before 3.30.1
Tp-LinkOmada Sg2016p Firmware
from 1.20.0 before 1.20.17
from 1.30.0 before 1.30.1
Tp-LinkOmada Sg2210mp Firmware
from 4.20.0 before 4.20.18
from 5.0.0 before 5.0.15
from 5.20.0 before 5.20.1
Tp-LinkOmada Sg2210p Firmware
from 5.20.0 before 5.20.18
from 5.30.0 before 5.30.1
Tp-LinkOmada Sg2210xmp-M2 Firmware
from 1.0.0 before 1.0.19
Tp-LinkOmada Sg2218 Firmware
from 1.20.0 before 1.20.17
from 1.30.0 before 1.30.1
Tp-LinkOmada Sg2218p Firmware
from 1.20.0 before 1.20.17
from 2.0.0 before 2.0.14
from 2.20.0 before 2.20.2
Tp-LinkOmada Sg2428lp Firmware
from 1.0.0 before 1.0.13
Tp-LinkOmada Sg2428p Firmware
from 5.20.0 before 5.20.20
from 5.30.0 before 5.30.16
Tp-LinkOmada Sg2452lp Firmware
from 1.0.0 before 1.0.13

Weakness classification

CWE-20CWE-787

References