{"id":"CVE-2025-15628","title":"Affected\nOmada devices rely on embedded certificates that are shared across deployments\nto establish trust between controllers and managed devices.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains the embedded certificates may be able to impersonate tru…","summary":"Affected\nOmada devices rely on embedded certificates that are shared across deployments\nto establish trust between controllers and managed devices.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains the embedded certificates may be able to impersonate tru…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-798"],"vendor":"tp-link","product":"omada_oc200_v3_firmware","affected":["omada_oc200_v3_firmware","omada_oc300_firmware","omada_oc400_firmware","omada_fusion_2.5g_firmware","omada_er707-m2_firmware","omada_tl-sg3452x_firmware","omada_sg3428xmpp_firmware","omada_sg3428xmp_firmware","omada_sg3428x_firmware","omada_sg2005p-pd_firmware","omada_sg3452p_firmware","omada_sg3452_firmware","omada_sg3428mp_firmware","omada_sg3428_firmware","omada_sg3210_firmware","omada_tl-sg3210_firmware","omada_sg2452lp_firmware","omada_sg2428p_firmware","omada_sg2428lp_firmware","omada_sg2218p_firmware","omada_sg2218_firmware","omada_sg2016p_firmware","omada_sg2210mp_firmware","omada_sg2210p_firmware","omada_sg2008p_firmware","omada_sg2008_firmware","omada_sg2206mp_firmware","omada_es210xpp-m2_firmware","omada_es210x-m2_firmware","omada_es206xpp-m2_firmware","omada_es206x-m2_firmware","omada_es228gmp_firmware","omada_es228gp_firmware","omada_es224g_firmware","omada_es220gp_firmware","omada_es216g_firmware","omada_es210gmp_firmware","omada_es210gp_firmware","omada_es208gp_firmware","omada_es208g_firmware","omada_es206gp_firmware","omada_es205gp_firmware","omada_es205g_firmware","omada_es220gmp_firmware","omada_es1024ge_firmware","omada_er7206_firmware","omada_er706w_firmware","omada_er8411_firmware","omada_er605_firmware","omada_er7412-m2_firmware","omada_er706w-4g_firmware","omada_er703wp-4g-outdoor_firmware","omada_er706wp-4g_firmware","omada_s7500-24y4c_firmware","omada_s7500-26xf6y_firmware","omada_s6500-48mpp6y_firmware","omada_s6500-24mpp4y_firmware","omada_s6500-48gp6xf_firmware","omada_s6500-48g6xf_firmware","omada_s6500-24gp4xf_firmware","omada_s6500-24g4xf_firmware","omada_sx6632yf_firmware","omada_sx3032f_firmware","omada_sx3016f_firmware","omada_sx3008f_firmware","omada_sg3428xf_firmware","omada_sx3832mpp_firmware","omada_sx3832_firmware","omada_sx3206hpp_firmware","omada_sg3428xpp-m2_firmware","omada_sg3428x-m2_firmware","omada_sg3218xp-m2_firmware","omada_sg3210xhp-m2_firmware","omada_sg3210x-m2_firmware","omada_sg2210xmp-m2_firmware","omada_sg6654xhp_firmware","omada_sg6654x_firmware","omada_sg6428xhp_firmware","omada_sg6428x_firmware","omada_sg5452xmpp_firmware","omada_sg5452x_firmware","omada_sg5428xmpp_firmware","omada_sg5428x_firmware","omada_sg3452xmpp_firmware","omada_sg3452xp_firmware","omada_ds1016ge_firmware","omada_ds108ge_firmware","omada_ds105ge_firmware","omada_ds1008x_firmware","omada_ds105x_firmware","omada_ds108g-m2_firmware","omada_ds105g-m2_firmware","omada_ds1024g_firmware","omada_ds1016g_firmware","omada_ds110gmp_firmware","omada_ds108g_firmware","omada_ds106gpp_firmware","omada_ds106p_firmware","omada_ds105g_firmware","omada_ds111p_firmware"],"published":"2026-08-03","updated":"2026-09-29","sourceUpdated":"2026-09-29T14:10:00.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15628","references":[{"url":"https://www.omadanetworks.com/en/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.omadanetworks.com/us/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5216/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd"],"epss":0.0032,"epssPercentile":0.22565,"ingestedAt":"2026-09-29T14:36:14.074Z","slug":"CVE-2025-15628","body":"## Overview\n\nAffected\nOmada devices rely on embedded certificates that are shared across deployments\nto establish trust between controllers and managed devices.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains the embedded certificates may be able to impersonate trusted\ncontrollers or devices and intercept affected communications.\n\n## Affected\n\n- `omada_oc200_v3_firmware`\n- `omada_oc300_firmware`\n- `omada_oc400_firmware`\n- `omada_fusion_2.5g_firmware`\n- `omada_er707-m2_firmware`\n- `omada_tl-sg3452x_firmware`\n- `omada_sg3428xmpp_firmware`\n- `omada_sg3428xmp_firmware`\n- `omada_sg3428x_firmware`\n- `omada_sg2005p-pd_firmware`\n- `omada_sg3452p_firmware`\n- `omada_sg3452_firmware`\n- `omada_sg3428mp_firmware`\n- `omada_sg3428_firmware`\n- `omada_sg3210_firmware`\n- `omada_tl-sg3210_firmware`\n- `omada_sg2452lp_firmware`\n- `omada_sg2428p_firmware`\n- `omada_sg2428lp_firmware`\n- `omada_sg2218p_firmware`\n- `omada_sg2218_firmware`\n- `omada_sg2016p_firmware`\n- `omada_sg2210mp_firmware`\n- `omada_sg2210p_firmware`\n- `omada_sg2008p_firmware`\n- `omada_sg2008_firmware`\n- `omada_sg2206mp_firmware`\n- `omada_es210xpp-m2_firmware`\n- `omada_es210x-m2_firmware`\n- `omada_es206xpp-m2_firmware`\n- `omada_es206x-m2_firmware`\n- `omada_es228gmp_firmware`\n- `omada_es228gp_firmware`\n- `omada_es224g_firmware`\n- `omada_es220gp_firmware`\n- `omada_es216g_firmware`\n- `omada_es210gmp_firmware`\n- `omada_es210gp_firmware`\n- `omada_es208gp_firmware`\n- `omada_es208g_firmware`\n- `omada_es206gp_firmware`\n- `omada_es205gp_firmware`\n- `omada_es205g_firmware`\n- `omada_es220gmp_firmware`\n- `omada_es1024ge_firmware`\n- `omada_er7206_firmware`\n- `omada_er706w_firmware`\n- `omada_er8411_firmware`\n- `omada_er605_firmware`\n- `omada_er7412-m2_firmware`\n- `omada_er706w-4g_firmware`\n- `omada_er703wp-4g-outdoor_firmware`\n- `omada_er706wp-4g_firmware`\n- `omada_s7500-24y4c_firmware`\n- `omada_s7500-26xf6y_firmware`\n- `omada_s6500-48mpp6y_firmware`\n- `omada_s6500-24mpp4y_firmware`\n- `omada_s6500-48gp6xf_firmware`\n- `omada_s6500-48g6xf_firmware`\n- `omada_s6500-24gp4xf_firmware`\n- `omada_s6500-24g4xf_firmware`\n- `omada_sx6632yf_firmware`\n- `omada_sx3032f_firmware`\n- `omada_sx3016f_firmware`\n- `omada_sx3008f_firmware`\n- `omada_sg3428xf_firmware`\n- `omada_sx3832mpp_firmware`\n- `omada_sx3832_firmware`\n- `omada_sx3206hpp_firmware`\n- `omada_sg3428xpp-m2_firmware`\n- `omada_sg3428x-m2_firmware`\n- `omada_sg3218xp-m2_firmware`\n- `omada_sg3210xhp-m2_firmware`\n- `omada_sg3210x-m2_firmware`\n- `omada_sg2210xmp-m2_firmware`\n- `omada_sg6654xhp_firmware`\n- `omada_sg6654x_firmware`\n- `omada_sg6428xhp_firmware`\n- `omada_sg6428x_firmware`\n- `omada_sg5452xmpp_firmware`\n- `omada_sg5452x_firmware`\n- `omada_sg5428xmpp_firmware`\n- `omada_sg5428x_firmware`\n- `omada_sg3452xmpp_firmware`\n- `omada_sg3452xp_firmware`\n- `omada_ds1016ge_firmware`\n- `omada_ds108ge_firmware`\n- `omada_ds105ge_firmware`\n- `omada_ds1008x_firmware`\n- `omada_ds105x_firmware`\n- `omada_ds108g-m2_firmware`\n- `omada_ds105g-m2_firmware`\n- `omada_ds1024g_firmware`\n- `omada_ds1016g_firmware`\n- `omada_ds110gmp_firmware`\n- `omada_ds108g_firmware`\n- `omada_ds106gpp_firmware`\n- `omada_ds106p_firmware`\n- `omada_ds105g_firmware`\n- `omada_ds111p_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}