Authentication Weakness on Omada Controllers, Gateways and Access Points
Summary
| CVE | CVE-2025-9290 |
|---|---|
| State | PUBLISHED |
| Assigner | TPLink |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-01-23 00:15:52 UTC |
| Updated | 2026-10-07 00:17:19 UTC |
| Description | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality. |
Risk And Classification
Primary CVSS: v4.0 6 MEDIUM from f23511db-6c3e-4e32-a477-6aa17d310630
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-760 | NVD-CWE-noinfo | CWE-760 CWE-760 Use of a One-Way Hash with a Predictable Salt
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | f23511db-6c3e-4e32-a477-6aa17d310630 | Secondary | 6 | MEDIUM | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6 | MEDIUM | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
HighAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Tp-link | Oc200 | 1 | All | All | All |
| Operating System | Tp-link | Oc200 Firmware | All | All | All | All |
| Hardware | Tp-link | Oc220 | 1 | All | All | All |
| Operating System | Tp-link | Oc220 Firmware | All | All | All | All |
| Hardware | Tp-link | Oc300 | 1.6 | All | All | All |
| Operating System | Tp-link | Oc300 Firmware | All | All | All | All |
| Hardware | Tp-link | Oc400 | 1.6 | All | All | All |
| Operating System | Tp-link | Oc400 Firmware | All | All | All | All |
| Application | Tp-link | Omada Controller | All | All | All | All |
| Application | Tp-link | Omada Controller | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.omadanetworks.com/us/download | f23511db-6c3e-4e32-a477-6aa17d310630 | support.omadanetworks.com | Product |
| support.omadanetworks.com/en/download | f23511db-6c3e-4e32-a477-6aa17d310630 | support.omadanetworks.com | Product |
| support.omadanetworks.com/us/document/114950 | f23511db-6c3e-4e32-a477-6aa17d310630 | support.omadanetworks.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies (en)
There are currently no legacy QID mappings associated with this CVE.