{"cve":"CVE-2026-19683","nvd":{"published":"2026-08-20T19:16:51.303","modified":"2026-10-26T10:10:00.140","status":"Analyzed","description":"A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. \n\n\n\n\n\nSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4},"cwes":["CWE-319"],"references":["https://www.omadanetworks.com/en/support/download/","https://www.omadanetworks.com/us/support/download/","https://www.tp-link.com/us/support/faq/5256/"],"products":["tp-link:dr3150_firmware","tp-link:dr3220v-4g_firmware","tp-link:dr3650v-4g_firmware","tp-link:dr3650v_firmware","tp-link:er603wp-4g-outdoor_firmware","tp-link:er605_firmware","tp-link:er605w_firmware","tp-link:er701-5g-outdoor_firmware","tp-link:er703wp-4g-outdoor_firmware","tp-link:er706w-4g_firmware","tp-link:er706w_firmware","tp-link:er706wp-4g_firmware","tp-link:er707-m2_firmware","tp-link:er7206_firmware","tp-link:er7212pc_firmware","tp-link:er7406_firmware","tp-link:er7412-m2_firmware","tp-link:er8411_firmware"],"source":"nvd","synced_at":"2026-10-26T10:28:23.151169805+00:00"},"epss":{"cve":"CVE-2026-19683","score":0.00345,"percentile":0.2775,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}