TP-Link SX3206HPP 1.20 Web Interface input validation

Summaryinfo

A vulnerability marked as critical has been reported in TP-Link SG2008P 3.2x, SG2008P 3.3x, SX3016F 1.3x, SX3016F 1.2x, SG3428 2.4x, SG3428XMP 3.3x, SG3428X 1.4x, SG3428XF 1.3x, SG3452P 3.4x, SG3428MP 6.3x, SG2218P 2.2x, SG2016P 1.3x, SG3452XP 2.3x, SG3428XMPP 1.2x, SG3452X 1.3x, SG2008 4.3x, SG3210 3.3x, SG2210MP 5.2x, SG2210P 5.3x, SG2218 1.3x, SG3452 1.3x, SG3210X-M2 1.2x, SG2210XMP-M2 1.x, SG2008 4.2x, SG2218P 1.2x, SG3210 3.2x, SG3428X-M2 1.2x, SX3832MPP 1.x, SG2218 1.2x, SX3832 1.x, SG2428LP 1.x, SL2428P 6.2x, SG3218XP-M2 1.x, SG3210XHP-M2 3.x, SG2218P 2.x, SG3210X-M2 1.x, SG2428P 5.3x, SG2210MP 4.2x, SG3452P 3.3x, SG3452 1.2x, SG2452LP 1.x, SX3032F 1.x, SG3452X 1.2x, SG3452XMPP 1.x, SG3428XPP-M2 1.2x, TL-SG3452P 3.0, SG2428P 5.2x, SG2210MP 5.x, SG2005P-PD 1.x, SG2016P 1.2x, SG3452XP 2.2x, SG3428XMP 3.2x, SG3428X 1.3x, SG3428XF 1.2x, SG3428MP 6.2x, TL-SG3428MP 5.x, SG3428 2.3x, SG3428XMPP 1.x, TL-SG2428P 4.x, SG2210P 5.2x, SX3008F 1.2x and SX3206HPP 1.20. This vulnerability affects unknown code of the component Web Interface. Performing a manipulation results in input validation. This vulnerability is identified as CVE-2026-1668. The attack can only be performed from the local network. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in TP-Link SG2008P 3.2x, SG2008P 3.3x, SX3016F 1.3x, SX3016F 1.2x, SG3428 2.4x, SG3428XMP 3.3x, SG3428X 1.4x, SG3428XF 1.3x, SG3452P 3.4x, SG3428MP 6.3x, SG2218P 2.2x, SG2016P 1.3x, SG3452XP 2.3x, SG3428XMPP 1.2x, SG3452X 1.3x, SG2008 4.3x, SG3210 3.3x, SG2210MP 5.2x, SG2210P 5.3x, SG2218 1.3x, SG3452 1.3x, SG3210X-M2 1.2x, SG2210XMP-M2 1.x, SG2008 4.2x, SG2218P 1.2x, SG3210 3.2x, SG3428X-M2 1.2x, SX3832MPP 1.x, SG2218 1.2x, SX3832 1.x, SG2428LP 1.x, SL2428P 6.2x, SG3218XP-M2 1.x, SG3210XHP-M2 3.x, SG2218P 2.x, SG3210X-M2 1.x, SG2428P 5.3x, SG2210MP 4.2x, SG3452P 3.3x, SG3452 1.2x, SG2452LP 1.x, SX3032F 1.x, SG3452X 1.2x, SG3452XMPP 1.x, SG3428XPP-M2 1.2x, TL-SG3452P 3.0, SG2428P 5.2x, SG2210MP 5.x, SG2005P-PD 1.x, SG2016P 1.2x, SG3452XP 2.2x, SG3428XMP 3.2x, SG3428X 1.3x, SG3428XF 1.2x, SG3428MP 6.2x, TL-SG3428MP 5.x, SG3428 2.3x, SG3428XMPP 1.x, TL-SG2428P 4.x, SG2210P 5.2x, SX3008F 1.2x and SX3206HPP 1.20. This affects an unknown code of the component Web Interface. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

The weakness was released by tangrs. It is possible to read the advisory at support.omadanetworks.com. This vulnerability is uniquely identified as CVE-2026-1668 since 01/29/2026. The exploitability is told to be difficult. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/20/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12049). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Messaging Software

Vendor

• TP-Link

Name

• SG2005P-PD 1.x
• SG2008 4.2x
• SG2008 4.3x
• SG2008P 3.2x
• SG2008P 3.3x
• SG2016P 1.2x
• SG2016P 1.3x
• SG2210MP 4.2x
• SG2210MP 5.2x
• SG2210MP 5.x
• SG2210P 5.2x
• SG2210P 5.3x
• SG2210XMP-M2 1.x
• SG2218 1.2x
• SG2218 1.3x
• SG2218P 1.2x
• SG2218P 2.2x
• SG2218P 2.x
• SG2428LP 1.x
• SG2428P 5.2x
• SG2428P 5.3x
• SG2452LP 1.x
• SG3210 3.2x
• SG3210 3.3x
• SG3210X-M2 1.2x
• SG3210X-M2 1.x
• SG3210XHP-M2 3.x
• SG3218XP-M2 1.x
• SG3428 2.3x
• SG3428 2.4x
• SG3428MP 6.2x
• SG3428MP 6.3x
• SG3428X-M2 1.2x
• SG3428X 1.3x
• SG3428X 1.4x
• SG3428XF 1.2x
• SG3428XF 1.3x
• SG3428XMP 3.2x
• SG3428XMP 3.3x
• SG3428XMPP 1.2x
• SG3428XMPP 1.x
• SG3428XPP-M2 1.2x
• SG3452 1.2x
• SG3452 1.3x
• SG3452P 3.3x
• SG3452P 3.4x
• SG3452X 1.2x
• SG3452X 1.3x
• SG3452XMPP 1.x
• SG3452XP 2.2x
• SG3452XP 2.3x
• SL2428P 6.2x
• SX3008F 1.2x
• SX3016F 1.2x
• SX3016F 1.3x
• SX3032F 1.x
• SX3206HPP 1.20
• SX3832 1.x
• SX3832MPP 1.x
• TL-SG2428P 4.x
• TL-SG3428MP 5.x
• TL-SG3452P 3.0

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion