CVE-2025-9291

Analyzed Analyzed - Analysis Complete

Certificate Validation Bypass in Omada Devices

Publication date: 2026-08-03

Last updated on: 2026-08-07

Assigner: TPLink

Description

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-07

Generated

2026-08-23

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2025-9291

EUVD

EUVD-2025-210607

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	omada_fusion_2.5g_firmware	*
tp-link	omada_er707-m2_firmware	*
tp-link	omada_er7206_firmware	*
tp-link	omada_er706w_firmware	*
tp-link	omada_er8411_firmware	*
tp-link	omada_er605_firmware	*
tp-link	omada_er7412-m2_firmware	*
tp-link	omada_er706w-4g_firmware	*
tp-link	omada_er703wp-4g-outdoor_firmware	*
tp-link	omada_er706wp-4g_firmware	*
tp-link	omada_s7500-24y4c_firmware	*
tp-link	omada_s7500-26xf6y_firmware	*
tp-link	omada_s6500-48mpp6y_firmware	*
tp-link	omada_s6500-24mpp4y_firmware	*
tp-link	omada_s6500-48gp6xf_firmware	*
tp-link	omada_s6500-48g6xf_firmware	*
tp-link	omada_s6500-24gp4xf_firmware	*
tp-link	omada_s6500-24g4xf_firmware	*
tp-link	omada_sx6632yf_firmware	*
tp-link	omada_sx3032f_firmware	*
tp-link	omada_sx3016f_firmware	*
tp-link	omada_sx3008f_firmware	*
tp-link	omada_sg3428xf_firmware	*
tp-link	omada_sx3832mpp_firmware	*
tp-link	omada_sx3832_firmware	*
tp-link	omada_sx3206hpp_firmware	*
tp-link	omada_sg3428xpp-m2_firmware	*
tp-link	omada_sg3428x-m2_firmware	*
tp-link	omada_sg3218xp-m2_firmware	*
tp-link	omada_sg3210xhp-m2_firmware	*
tp-link	omada_sg3210x-m2_firmware	*
tp-link	omada_sg2210xmp-m2_firmware	*
tp-link	omada_sg6654xhp_firmware	*
tp-link	omada_sg6654x_firmware	*
tp-link	omada_sg6428xhp_firmware	*
tp-link	omada_sg6428x_firmware	*
tp-link	omada_sg5452xmpp_firmware	*
tp-link	omada_sg5452x_firmware	*
tp-link	omada_sg5428xmpp_firmware	*
tp-link	omada_sg5428x_firmware	*
tp-link	omada_sg3452xmpp_firmware	*
tp-link	omada_sg3452xp_firmware	*
tp-link	omada_tl-sg3452x_firmware	*
tp-link	omada_sg3428xmpp_firmware	*
tp-link	omada_sg3428xmp_firmware	*
tp-link	omada_sg3428x_firmware	*
tp-link	omada_sg2005p-pd_firmware	*
tp-link	omada_sg3452p_firmware	*
tp-link	omada_sg3452_firmware	*
tp-link	omada_sg3428mp_firmware	*
tp-link	omada_sg3428_firmware	*
tp-link	omada_sg3210_firmware	*
tp-link	omada_tl-sg3210_firmware	*
tp-link	omada_sg2452lp_firmware	*
tp-link	omada_sg2428p_firmware	*
tp-link	omada_sg2428lp_firmware	*
tp-link	omada_sg2218p_firmware	*
tp-link	omada_sg2218_firmware	*
tp-link	omada_sg2016p_firmware	*
tp-link	omada_sg2210mp_firmware	*
tp-link	omada_sg2210p_firmware	*
tp-link	omada_sg2008p_firmware	*
tp-link	omada_sg2008_firmware	*
tp-link	omada_sg2206mp_firmware	*
tp-link	omada_es210xpp-m2_firmware	*
tp-link	omada_es210x-m2_firmware	*
tp-link	omada_es206xpp-m2_firmware	*
tp-link	omada_es206x-m2_firmware	*
tp-link	omada_es228gmp_firmware	*
tp-link	omada_es228gp_firmware	*
tp-link	omada_es224g_firmware	*
tp-link	omada_es220gp_firmware	*
tp-link	omada_es216g_firmware	*
tp-link	omada_es210gmp_firmware	*
tp-link	omada_es210gp_firmware	*
tp-link	omada_es208gp_firmware	*
tp-link	omada_es208g_firmware	*
tp-link	omada_es206gp_firmware	*
tp-link	omada_es205gp_firmware	*
tp-link	omada_es205g_firmware	*
tp-link	omada_es220gmp_firmware	*
tp-link	omada_es1024ge_firmware	*
tp-link	omada_ds1016ge_firmware	*
tp-link	omada_ds108ge_firmware	*
tp-link	omada_ds105ge_firmware	*
tp-link	omada_ds1008x_firmware	*
tp-link	omada_ds105x_firmware	*
tp-link	omada_ds108g-m2_firmware	*
tp-link	omada_ds105g-m2_firmware	*
tp-link	omada_ds1024g_firmware	*
tp-link	omada_ds1016g_firmware	*
tp-link	omada_ds110gmp_firmware	*
tp-link	omada_ds108g_firmware	*
tp-link	omada_ds106gpp_firmware	*
tp-link	omada_ds106p_firmware	*
tp-link	omada_ds105g_firmware	*
tp-link	omada_ds111p_firmware	*
tp-link	omada_ds1018gmp_firmware	*
tp-link	omada_ds108gp_firmware	*
tp-link	omada_ds105gp_firmware	*
tp-link	omada_ies210gpp_firmware	*
tp-link	omada_ies206gpp_firmware	*
tp-link	omada_ies208g_firmware	*
tp-link	omada_ies206g_firmware	*
tp-link	omada_eap660hd_firmware	*
tp-link	omada_eap620hd_firmware	*
tp-link	omada_eap610_firmware	*
tp-link	omada_eap615-wall_firmware	*
tp-link	omada_eap610-outdoor_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability is a certification validation weakness in communication between Omada devices and cloud controllers. The system fails to properly verify that a certificate matches the expected cloud controller hostname, potentially allowing attackers to bypass certificate validation protections.

Detection Guidance

This vulnerability involves weak certificate validation in Omada devices communicating with cloud controllers. Detection requires checking if devices accept certificates that do not match the expected cloud controller hostname. Use network monitoring tools to inspect TLS handshakes for improper certificate validation. No specific commands are provided in the context.

Impact Analysis

Exploitation may allow attackers to intercept or modify communications between affected devices and cloud controllers. This could lead to unauthorized access, data breaches, or manipulation of device behavior.

Compliance Impact

This vulnerability may allow interception or modification of communication between Omada devices and cloud controllers, potentially exposing sensitive data. This could impact compliance with GDPR by risking unauthorized access to personal data and HIPAA by compromising protected health information during transmission.

Mitigation Strategies

Update Omada devices and cloud controllers to the latest firmware versions to ensure proper certificate validation. Verify that all communication between devices and cloud controllers uses TLS with strict hostname verification. Monitor network traffic for unauthorized interception or modification attempts.

Hi! I’m here to help you understand CVE-2025-9291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70