CVE-2025-15631

Analyzed Analyzed - Analysis Complete

Weak Password Hashing in Omada Devices

Publication date: 2026-08-03

Last updated on: 2026-08-07

Assigner: TPLink

Description

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-07

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2025-15631

EUVD

EUVD-2025-210613

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	omada_fusion_2.5g_firmware	*
tp-link	omada_er707-m2_firmware	*
tp-link	omada_er7206_firmware	*
tp-link	omada_er706w_firmware	*
tp-link	omada_er8411_firmware	*
tp-link	omada_er605_firmware	*
tp-link	omada_er7412-m2_firmware	*
tp-link	omada_er706w-4g_firmware	*
tp-link	omada_er703wp-4g-outdoor_firmware	*
tp-link	omada_er706wp-4g_firmware	*
tp-link	omada_s7500-24y4c_firmware	*
tp-link	omada_s7500-26xf6y_firmware	*
tp-link	omada_s6500-48mpp6y_firmware	*
tp-link	omada_s6500-24mpp4y_firmware	*
tp-link	omada_s6500-48gp6xf_firmware	*
tp-link	omada_s6500-48g6xf_firmware	*
tp-link	omada_s6500-24gp4xf_firmware	*
tp-link	omada_s6500-24g4xf_firmware	*
tp-link	omada_sx6632yf_firmware	*
tp-link	omada_sx3032f_firmware	*
tp-link	omada_sx3016f_firmware	*
tp-link	omada_sx3008f_firmware	*
tp-link	omada_sg3428xf_firmware	*
tp-link	omada_sx3832mpp_firmware	*
tp-link	omada_sx3832_firmware	*
tp-link	omada_sx3206hpp_firmware	*
tp-link	omada_sg3428xpp-m2_firmware	*
tp-link	omada_sg3428x-m2_firmware	*
tp-link	omada_sg3218xp-m2_firmware	*
tp-link	omada_sg3210xhp-m2_firmware	*
tp-link	omada_sg3210x-m2_firmware	*
tp-link	omada_sg2210xmp-m2_firmware	*
tp-link	omada_sg6654xhp_firmware	*
tp-link	omada_sg6654x_firmware	*
tp-link	omada_sg6428xhp_firmware	*
tp-link	omada_sg6428x_firmware	*
tp-link	omada_sg5452xmpp_firmware	*
tp-link	omada_sg5452x_firmware	*
tp-link	omada_sg5428xmpp_firmware	*
tp-link	omada_sg5428x_firmware	*
tp-link	omada_sg3452xmpp_firmware	*
tp-link	omada_sg3452xp_firmware	*
tp-link	omada_tl-sg3452x_firmware	*
tp-link	omada_sg3428xmpp_firmware	*
tp-link	omada_sg3428xmp_firmware	*
tp-link	omada_sg3428x_firmware	*
tp-link	omada_sg2005p-pd_firmware	*
tp-link	omada_sg3452p_firmware	*
tp-link	omada_sg3452_firmware	*
tp-link	omada_sg3428mp_firmware	*
tp-link	omada_sg3428_firmware	*
tp-link	omada_sg3210_firmware	*
tp-link	omada_tl-sg3210_firmware	*
tp-link	omada_sg2452lp_firmware	*
tp-link	omada_sg2428p_firmware	*
tp-link	omada_sg2428lp_firmware	*
tp-link	omada_sg2218p_firmware	*
tp-link	omada_sg2218_firmware	*
tp-link	omada_sg2016p_firmware	*
tp-link	omada_sg2210mp_firmware	*
tp-link	omada_sg2210p_firmware	*
tp-link	omada_sg2008p_firmware	*
tp-link	omada_sg2008_firmware	*
tp-link	omada_sg2206mp_firmware	*
tp-link	omada_es210xpp-m2_firmware	*
tp-link	omada_es210x-m2_firmware	*
tp-link	omada_es206xpp-m2_firmware	*
tp-link	omada_es206x-m2_firmware	*
tp-link	omada_es228gmp_firmware	*
tp-link	omada_es228gp_firmware	*
tp-link	omada_es224g_firmware	*
tp-link	omada_es220gp_firmware	*
tp-link	omada_es216g_firmware	*
tp-link	omada_es210gmp_firmware	*
tp-link	omada_es210gp_firmware	*
tp-link	omada_es208gp_firmware	*
tp-link	omada_es208g_firmware	*
tp-link	omada_es206gp_firmware	*
tp-link	omada_es205gp_firmware	*
tp-link	omada_es205g_firmware	*
tp-link	omada_es220gmp_firmware	*
tp-link	omada_es1024ge_firmware	*
tp-link	omada_ds1016ge_firmware	*
tp-link	omada_ds108ge_firmware	*
tp-link	omada_ds105ge_firmware	*
tp-link	omada_ds1008x_firmware	*
tp-link	omada_ds105x_firmware	*
tp-link	omada_ds108g-m2_firmware	*
tp-link	omada_ds105g-m2_firmware	*
tp-link	omada_ds1024g_firmware	*
tp-link	omada_ds1016g_firmware	*
tp-link	omada_ds110gmp_firmware	*
tp-link	omada_ds108g_firmware	*
tp-link	omada_ds106gpp_firmware	*
tp-link	omada_ds106p_firmware	*
tp-link	omada_ds105g_firmware	*
tp-link	omada_ds111p_firmware	*
tp-link	omada_ds1018gmp_firmware	*
tp-link	omada_ds108gp_firmware	*
tp-link	omada_ds105gp_firmware	*
tp-link	omada_ies210gpp_firmware	*
tp-link	omada_ies206gpp_firmware	*
tp-link	omada_ies208g_firmware	*
tp-link	omada_ies206g_firmware	*
tp-link	omada_eap660hd_firmware	*
tp-link	omada_eap620hd_firmware	*
tp-link	omada_eap610_firmware	*
tp-link	omada_eap615-wall_firmware	*
tp-link	omada_eap610-outdoor_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-759	The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Attack-Flow Graph

Executive Summary

This vulnerability is a cryptographic weakness in Omada devices where site credentials are protected using an outdated hashing algorithm. This makes it easier for attackers to recover valid credentials if they gain access to stored credential data, potentially allowing unauthorized access to devices or management environments.

Detection Guidance

This vulnerability involves weak cryptographic hashing of site credentials on Omada devices. Detection requires checking stored credential files or configurations for the use of legacy hashing algorithms. Review device logs and configuration files for signs of exposed or weakly hashed credentials. No specific commands are provided in the available context.

Impact Analysis

If exploited, an attacker could recover your credentials and gain unauthorized access to your Omada devices or management systems. This could lead to data breaches, loss of control over network devices, or further attacks on connected systems.

Compliance Impact

The vulnerability may lead to unauthorized access to stored credentials, potentially exposing sensitive data. This could violate compliance requirements under GDPR and HIPAA, which mandate strong protection of personal and health information.

Mitigation Strategies

Immediately update Omada devices to the latest firmware version to replace the weak hashing algorithm with a stronger one. Review stored credentials for any signs of compromise and rotate all passwords for affected devices and management environments.

Hi! I’m here to help you understand CVE-2025-15631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70