CVE-2025-15544

Analyzed Analyzed - Analysis Complete

Weak Hashing in Omada Controller Adoption Process

Publication date: 2026-08-03

Last updated on: 2026-08-07

Assigner: TPLink

Description

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-07

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2025-15544

EUVD

EUVD-2025-210608

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	omada_oc200_v3_firmware	*
tp-link	omada_oc300_firmware	*
tp-link	omada_oc400_firmware	*
tp-link	omada_fusion_2.5g_firmware	*
tp-link	omada_er707-m2_firmware	*
tp-link	omada_er7206_firmware	*
tp-link	omada_er706w_firmware	*
tp-link	omada_er8411_firmware	*
tp-link	omada_er605_firmware	*
tp-link	omada_er7412-m2_firmware	*
tp-link	omada_er706w-4g_firmware	*
tp-link	omada_er703wp-4g-outdoor_firmware	*
tp-link	omada_er706wp-4g_firmware	*
tp-link	omada_s7500-24y4c_firmware	*
tp-link	omada_s7500-26xf6y_firmware	*
tp-link	omada_s6500-48mpp6y_firmware	*
tp-link	omada_s6500-24mpp4y_firmware	*
tp-link	omada_s6500-48gp6xf_firmware	*
tp-link	omada_s6500-48g6xf_firmware	*
tp-link	omada_s6500-24gp4xf_firmware	*
tp-link	omada_s6500-24g4xf_firmware	*
tp-link	omada_sx6632yf_firmware	*
tp-link	omada_sx3032f_firmware	*
tp-link	omada_sx3016f_firmware	*
tp-link	omada_sx3008f_firmware	*
tp-link	omada_sg3428xf_firmware	*
tp-link	omada_sx3832mpp_firmware	*
tp-link	omada_sx3832_firmware	*
tp-link	omada_sx3206hpp_firmware	*
tp-link	omada_sg3428xpp-m2_firmware	*
tp-link	omada_sg3428x-m2_firmware	*
tp-link	omada_sg3218xp-m2_firmware	*
tp-link	omada_sg3210xhp-m2_firmware	*
tp-link	omada_sg3210x-m2_firmware	*
tp-link	omada_sg2210xmp-m2_firmware	*
tp-link	omada_sg6654xhp_firmware	*
tp-link	omada_sg6654x_firmware	*
tp-link	omada_sg6428xhp_firmware	*
tp-link	omada_sg6428x_firmware	*
tp-link	omada_sg5452xmpp_firmware	*
tp-link	omada_sg5452x_firmware	*
tp-link	omada_sg5428xmpp_firmware	*
tp-link	omada_sg5428x_firmware	*
tp-link	omada_sg3452xmpp_firmware	*
tp-link	omada_sg3452xp_firmware	*
tp-link	omada_tl-sg3452x_firmware	*
tp-link	omada_sg3428xmpp_firmware	*
tp-link	omada_sg3428xmp_firmware	*
tp-link	omada_sg3428x_firmware	*
tp-link	omada_sg2005p-pd_firmware	*
tp-link	omada_sg3452p_firmware	*
tp-link	omada_sg3452_firmware	*
tp-link	omada_sg3428mp_firmware	*
tp-link	omada_sg3428_firmware	*
tp-link	omada_sg3210_firmware	*
tp-link	omada_tl-sg3210_firmware	*
tp-link	omada_sg2452lp_firmware	*
tp-link	omada_sg2428p_firmware	*
tp-link	omada_sg2428lp_firmware	*
tp-link	omada_sg2218p_firmware	*
tp-link	omada_sg2218_firmware	*
tp-link	omada_sg2016p_firmware	*
tp-link	omada_sg2210mp_firmware	*
tp-link	omada_sg2210p_firmware	*
tp-link	omada_sg2008p_firmware	*
tp-link	omada_sg2008_firmware	*
tp-link	omada_sg2206mp_firmware	*
tp-link	omada_es210xpp-m2_firmware	*
tp-link	omada_es210x-m2_firmware	*
tp-link	omada_es206xpp-m2_firmware	*
tp-link	omada_es206x-m2_firmware	*
tp-link	omada_es228gmp_firmware	*
tp-link	omada_es228gp_firmware	*
tp-link	omada_es224g_firmware	*
tp-link	omada_es220gp_firmware	*
tp-link	omada_es216g_firmware	*
tp-link	omada_es210gmp_firmware	*
tp-link	omada_es210gp_firmware	*
tp-link	omada_es208gp_firmware	*
tp-link	omada_es208g_firmware	*
tp-link	omada_es206gp_firmware	*
tp-link	omada_es205gp_firmware	*
tp-link	omada_es205g_firmware	*
tp-link	omada_es220gmp_firmware	*
tp-link	omada_es1024ge_firmware	*
tp-link	omada_ds1016ge_firmware	*
tp-link	omada_ds108ge_firmware	*
tp-link	omada_ds105ge_firmware	*
tp-link	omada_ds1008x_firmware	*
tp-link	omada_ds105x_firmware	*
tp-link	omada_ds108g-m2_firmware	*
tp-link	omada_ds105g-m2_firmware	*
tp-link	omada_ds1024g_firmware	*
tp-link	omada_ds1016g_firmware	*
tp-link	omada_ds110gmp_firmware	*
tp-link	omada_ds108g_firmware	*
tp-link	omada_ds106gpp_firmware	*
tp-link	omada_ds106p_firmware	*
tp-link	omada_ds105g_firmware	*
tp-link	omada_ds111p_firmware	*
tp-link	omada_ds1018gmp_firmware	*
tp-link	omada_ds108gp_firmware	*
tp-link	omada_ds105gp_firmware	*
tp-link	omada_ies210gpp_firmware	*
tp-link	omada_ies206gpp_firmware	*
tp-link	omada_ies208g_firmware	*
tp-link	omada_ies206g_firmware	*
tp-link	omada_eap660hd_firmware	*
tp-link	omada_eap620hd_firmware	*
tp-link	omada_eap610_firmware	*
tp-link	omada_eap615-wall_firmware	*
tp-link	omada_eap610-outdoor_firmware	*
tp-link	omada	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-759	The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Attack-Flow Graph

Executive Summary

This vulnerability is a cryptographic weakness in the Omada device adoption process. During adoption, authentication credentials for site management are transmitted using a weak hashing algorithm that fails to provide adequate protection. An attacker who intercepts this traffic could recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

Detection Guidance

This vulnerability involves weak hashing of credentials during Omada device adoption. Detection requires monitoring network traffic for adoption-related authentication exchanges. Use packet capture tools like tcpdump or Wireshark to inspect adoption traffic for weak hash algorithms or plaintext credential transmission. Look for unencrypted or weakly encrypted credential exchanges during device adoption processes.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain unauthorized access to your Omada devices or the entire managed environment. This may lead to data breaches, unauthorized configuration changes, or disruption of services relying on these devices.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized access risks. It may result in data breaches, loss of sensitive information, and failure to meet security requirements for protecting personal or health data.

Mitigation Strategies

Immediately update Omada devices and controller software to the latest patched versions to address the weak hashing algorithm in the adoption process. Disable adoption over untrusted networks and use secure, encrypted channels for all authentication traffic.

Hi! I’m here to help you understand CVE-2025-15544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70