Nixpkgs security tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-19683
6.3 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 weeks, 5 days ago Activity log
  • Created suggestion 2 weeks, 5 days ago
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.  Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

Affected products

v1
  • <1.2.6 Build 20260723 Rel.41321
ER605 v2
  • <2.4.4 Build 20260630 Rel.14398
DR3150 v1
  • <1.0.1 Build 20260722 Rel.16854
ER605W v2
  • <2.0.4 Build 20260723 Rel.43763
ER706W v1
  • <1.2.11 Build 20260723 Rel.41567
ER7206 v2
  • <2.3.5 Build 20260625 Rel.43136
ER7406 v1
  • <1.3.4 Build 20260625 Rel.43136
ER8411 v1
  • <1.4.1 Build 20260708 Rel.64832
DR3650v v1
  • <1.2.0 Build 20260630 Rel.83311
ER707-M2 v1
  • <1.4.4 Build 20260625 Rel.43063
ER7212PC v2
  • <2.4.3 Build 20260722 Rel.40250
ER706W-4G v2
  • <2.1.11 Build 20260723 Rel.41624
ER7412-M2 v1
  • <1.2.0 Build 20260630 Rel.82947
DR3220v-4G v1
  • <1.2.0 Build 20260630 Rel.82652
DR3650v-4G v1
  • <1.2.0 Build 20260630 Rel.83347
ER706WP-4G v1
  • <1.1.11 Build 20260723 Rel.41624
ER701-5G-Outdoor v1
  • <1.0.3 Build 20260723 Rel.40931
ER603WP-4G-Outdoor v1
  • <1.0.2 Build 20260723 Rel.43271
ER703WP-4G-Outdoor v1
  • <1.1.7 Build 20260723 Rel.41712

Matching in nixpkgs

pkgs.av1an

Cross-platform command-line encoding framework

pkgs.dav1d

Cross-platform AV1 decoder focused on speed and correctness

pkgs.rav1d

AV1 cross-platform decoder, Rust port of dav1d

pkgs.rav1e

Fastest and safest AV1 encoder

pkgs.drumkv1

Old-school drum-kit sampler synthesizer with stereo fx

pkgs.padthv1

Polyphonic additive synthesizer

pkgs.samplv1

Old-school all-digital polyphonic sampler synthesizer with stereo fx

pkgs.svt-av1

AV1-compliant encoder/decoder library core

pkgs.synthv1

Old-school 4-oscillator subtractive polyphonic synthesizer with stereo fx

pkgs.svt-av1-hdr

Scalable Video Technology AV1 Encoder and Decoder

pkgs.sbclPackages.jzon

None

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.luaPackages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.lua51Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.lua52Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.lua53Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.lua54Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.lua55Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.luajitPackages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

  • nixos-unstable 0
    • nixpkgs-unstable 0
    • nixos-unstable-small 0
  • nixos-26.05 0
    • nixos-26.05-small 0
    • nixpkgs-26.05-darwin 0

pkgs.sbclPackages.swap-bytes

None

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.sbclPackages.hunchentoot

None

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.sbclPackages.parse-number

None

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.sbclPackages.static-vectors

None

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.chickenPackages_5.chickenEggs.ephem

A wrapper for libnova a 'general purpose, double precision, Celestial Mechanics, Astrometry and Astrodynamics library.'

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin

pkgs.obs-studio-plugins.obs-stroke-glow-shadow

OBS plugin to provide efficient Stroke, Glow, and Shadow effects on masked sources

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small
    • nixpkgs-26.05-darwin