{"id":"CVE-2025-15544","title":"A cryptographic\nweakness exists in the Omada device adoption process.  During adoption, authentication credentials associated\nwith site management are transmitted using a weak hashing algorithm that does\nnot provide sufficient protection…","summary":"A cryptographic\nweakness exists in the Omada device adoption process.  During adoption, authentication credentials associated\nwith site management are transmitted using a weak hashing algorithm that does\nnot provide sufficient protection…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-759"],"vendor":"tp-link","product":"omada_oc200_v3_firmware","affected":["omada_oc200_v3_firmware","omada_oc300_firmware","omada_oc400_firmware","omada_fusion_2.5g_firmware","omada_er707-m2_firmware","omada_er7206_firmware","omada_er706w_firmware","omada_er8411_firmware","omada_er605_firmware","omada_er7412-m2_firmware","omada_er706w-4g_firmware","omada_er703wp-4g-outdoor_firmware","omada_er706wp-4g_firmware","omada_s7500-24y4c_firmware","omada_s7500-26xf6y_firmware","omada_s6500-48mpp6y_firmware","omada_s6500-24mpp4y_firmware","omada_s6500-48gp6xf_firmware","omada_s6500-48g6xf_firmware","omada_s6500-24gp4xf_firmware","omada_s6500-24g4xf_firmware","omada_sx6632yf_firmware","omada_sx3032f_firmware","omada_sx3016f_firmware","omada_sx3008f_firmware","omada_sg3428xf_firmware","omada_sx3832mpp_firmware","omada_sx3832_firmware","omada_sx3206hpp_firmware","omada_sg3428xpp-m2_firmware","omada_sg3428x-m2_firmware","omada_sg3218xp-m2_firmware","omada_sg3210xhp-m2_firmware","omada_sg3210x-m2_firmware","omada_sg2210xmp-m2_firmware","omada_sg6654xhp_firmware","omada_sg6654x_firmware","omada_sg6428xhp_firmware","omada_sg6428x_firmware","omada_sg5452xmpp_firmware","omada_sg5452x_firmware","omada_sg5428xmpp_firmware","omada_sg5428x_firmware","omada_sg3452xmpp_firmware","omada_sg3452xp_firmware","omada_tl-sg3452x_firmware","omada_sg3428xmpp_firmware","omada_sg3428xmp_firmware","omada_sg3428x_firmware","omada_sg2005p-pd_firmware","omada_sg3452p_firmware","omada_sg3452_firmware","omada_sg3428mp_firmware","omada_sg3428_firmware","omada_sg3210_firmware","omada_tl-sg3210_firmware","omada_sg2452lp_firmware","omada_sg2428p_firmware","omada_sg2428lp_firmware","omada_sg2218p_firmware","omada_sg2218_firmware","omada_sg2016p_firmware","omada_sg2210mp_firmware","omada_sg2210p_firmware","omada_sg2008p_firmware","omada_sg2008_firmware","omada_sg2206mp_firmware","omada_es210xpp-m2_firmware","omada_es210x-m2_firmware","omada_es206xpp-m2_firmware","omada_es206x-m2_firmware","omada_es228gmp_firmware","omada_es228gp_firmware","omada_es224g_firmware","omada_es220gp_firmware","omada_es216g_firmware","omada_es210gmp_firmware","omada_es210gp_firmware","omada_es208gp_firmware","omada_es208g_firmware","omada_es206gp_firmware","omada_es205gp_firmware","omada_es205g_firmware","omada_es220gmp_firmware","omada_es1024ge_firmware","omada_ds1016ge_firmware","omada_ds108ge_firmware","omada_ds105ge_firmware","omada_ds1008x_firmware","omada_ds105x_firmware","omada_ds108g-m2_firmware","omada_ds105g-m2_firmware","omada_ds1024g_firmware","omada_ds1016g_firmware","omada_ds110gmp_firmware","omada_ds108g_firmware","omada_ds106gpp_firmware","omada_ds106p_firmware","omada_ds105g_firmware","omada_ds111p_firmware"],"published":"2026-08-03","updated":"2026-09-29","sourceUpdated":"2026-09-29T14:10:00.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15544","references":[{"url":"https://www.omadanetworks.com/en/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.omadanetworks.com/us/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5216/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd"],"epss":0.00343,"epssPercentile":0.2524,"ingestedAt":"2026-09-29T14:36:14.073Z","slug":"CVE-2025-15544","body":"## Overview\n\nA cryptographic\nweakness exists in the Omada device adoption process.  During adoption, authentication credentials associated\nwith site management are transmitted using a weak hashing algorithm that does\nnot provide sufficient protection. \n\n\n\n\n\n\n\n\n\nAn attacker who\nsuccessfully intercepts adoption-related authentication traffic may be able to\nrecover valid credentials and gain unauthorized access to managed devices or\ncontroller-managed environments.\n\n## Affected\n\n- `omada_oc200_v3_firmware`\n- `omada_oc300_firmware`\n- `omada_oc400_firmware`\n- `omada_fusion_2.5g_firmware`\n- `omada_er707-m2_firmware`\n- `omada_er7206_firmware`\n- `omada_er706w_firmware`\n- `omada_er8411_firmware`\n- `omada_er605_firmware`\n- `omada_er7412-m2_firmware`\n- `omada_er706w-4g_firmware`\n- `omada_er703wp-4g-outdoor_firmware`\n- `omada_er706wp-4g_firmware`\n- `omada_s7500-24y4c_firmware`\n- `omada_s7500-26xf6y_firmware`\n- `omada_s6500-48mpp6y_firmware`\n- `omada_s6500-24mpp4y_firmware`\n- `omada_s6500-48gp6xf_firmware`\n- `omada_s6500-48g6xf_firmware`\n- `omada_s6500-24gp4xf_firmware`\n- `omada_s6500-24g4xf_firmware`\n- `omada_sx6632yf_firmware`\n- `omada_sx3032f_firmware`\n- `omada_sx3016f_firmware`\n- `omada_sx3008f_firmware`\n- `omada_sg3428xf_firmware`\n- `omada_sx3832mpp_firmware`\n- `omada_sx3832_firmware`\n- `omada_sx3206hpp_firmware`\n- `omada_sg3428xpp-m2_firmware`\n- `omada_sg3428x-m2_firmware`\n- `omada_sg3218xp-m2_firmware`\n- `omada_sg3210xhp-m2_firmware`\n- `omada_sg3210x-m2_firmware`\n- `omada_sg2210xmp-m2_firmware`\n- `omada_sg6654xhp_firmware`\n- `omada_sg6654x_firmware`\n- `omada_sg6428xhp_firmware`\n- `omada_sg6428x_firmware`\n- `omada_sg5452xmpp_firmware`\n- `omada_sg5452x_firmware`\n- `omada_sg5428xmpp_firmware`\n- `omada_sg5428x_firmware`\n- `omada_sg3452xmpp_firmware`\n- `omada_sg3452xp_firmware`\n- `omada_tl-sg3452x_firmware`\n- `omada_sg3428xmpp_firmware`\n- `omada_sg3428xmp_firmware`\n- `omada_sg3428x_firmware`\n- `omada_sg2005p-pd_firmware`\n- `omada_sg3452p_firmware`\n- `omada_sg3452_firmware`\n- `omada_sg3428mp_firmware`\n- `omada_sg3428_firmware`\n- `omada_sg3210_firmware`\n- `omada_tl-sg3210_firmware`\n- `omada_sg2452lp_firmware`\n- `omada_sg2428p_firmware`\n- `omada_sg2428lp_firmware`\n- `omada_sg2218p_firmware`\n- `omada_sg2218_firmware`\n- `omada_sg2016p_firmware`\n- `omada_sg2210mp_firmware`\n- `omada_sg2210p_firmware`\n- `omada_sg2008p_firmware`\n- `omada_sg2008_firmware`\n- `omada_sg2206mp_firmware`\n- `omada_es210xpp-m2_firmware`\n- `omada_es210x-m2_firmware`\n- `omada_es206xpp-m2_firmware`\n- `omada_es206x-m2_firmware`\n- `omada_es228gmp_firmware`\n- `omada_es228gp_firmware`\n- `omada_es224g_firmware`\n- `omada_es220gp_firmware`\n- `omada_es216g_firmware`\n- `omada_es210gmp_firmware`\n- `omada_es210gp_firmware`\n- `omada_es208gp_firmware`\n- `omada_es208g_firmware`\n- `omada_es206gp_firmware`\n- `omada_es205gp_firmware`\n- `omada_es205g_firmware`\n- `omada_es220gmp_firmware`\n- `omada_es1024ge_firmware`\n- `omada_ds1016ge_firmware`\n- `omada_ds108ge_firmware`\n- `omada_ds105ge_firmware`\n- `omada_ds1008x_firmware`\n- `omada_ds105x_firmware`\n- `omada_ds108g-m2_firmware`\n- `omada_ds105g-m2_firmware`\n- `omada_ds1024g_firmware`\n- `omada_ds1016g_firmware`\n- `omada_ds110gmp_firmware`\n- `omada_ds108g_firmware`\n- `omada_ds106gpp_firmware`\n- `omada_ds106p_firmware`\n- `omada_ds105g_firmware`\n- `omada_ds111p_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}