Medium severity · published Jan 22, 2026
CVE-2025-9290
Authentication Weakness on Omada Controllers, Gateways and Access Points
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Omada Access Point (EAP215 Bridge KIT 3.0, EAP211 Bridge KIT 3.0) · TP-Link Systems Inc.
before 1.1.4 Build 20251112 Rel.34769 · source: vendor
OA
Omada Access Point (EAP230-Wall v1.0, EAP235-Wall v1.0) · TP-Link Systems Inc.
before 3.3.1 Build 20251203 Rel.58135 · source: vendor
OA
Omada Access Point (EAP603-Outdoor v1.0, EAP615-Wall v1.0/v1.20) · TP-Link Systems Inc.
before 1.5.1 · source: vendor
OA
OA
Omada Access Point (EAP615-Wall v1.0/v1.20) · TP-Link Systems Inc.
before 1.5.10 Build 20250903 Rel.49784 · source: vendor
OA
Omada Access Point (EAP650GP-Desktop 1.0) · TP-Link Systems Inc.
before 1.0.1 Build 20250819 Rel.60298 · source: vendor
OA
Omada Access Point (EAP653 UR v1.0) · TP-Link Systems Inc.
before 1.4.2 Build 20251208 Rel.43830 · source: vendor
OA
Omada Access Point (EAP653 v1.0, EAP650-Outdoor v1.0) · TP-Link Systems Inc.
before 1.3.3 Build 20251111 Rel.72627 · source: vendor
OA
Omada Access Point (EAP655-Wall v1.0) · TP-Link Systems Inc.
before 1.6.2 Build 20251107 Rel.35700 · source: vendor
OA
OA
Omada Access Point (EAP723 v1.0, EAP772 v2.0, EAP772-Outdoor v 1.0, EAP770 v2.0) · TP-Link Systems Inc.
before 1.3.2 Build 20250901 Rel.52255 · source: vendor
Affected product
OA
Omada Access Point (EAP215 Bridge KIT 3.0, EAP211 Bridge KIT 3.0)
TP-Link Systems Inc.
