CVE-2026-1668 HIGH

CVE-2026-1668: Input Validation Vulnerability on Multiple Omada Switches

Vendor Tp-Link Systems Inc.
Product SG2008P 3.2x
Weakness CWE-20 · Input validation
Published March 13, 2026
Last update March 13, 2026

CVSS base score

7.7/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

Key dates

02Disclosure timeline

March 13, 2026 CVE published
March 13, 2026 Record updated