{"id":"CVE-2025-15631","title":"A\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential dat…","summary":"A\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential dat…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-759"],"vendor":"tp-link","product":"omada_fusion_2.5g_firmware","affected":["omada_fusion_2.5g_firmware","omada_er707-m2_firmware","omada_er7206_firmware","omada_er706w_firmware","omada_er8411_firmware","omada_er605_firmware","omada_er7412-m2_firmware","omada_er706w-4g_firmware","omada_er703wp-4g-outdoor_firmware","omada_er706wp-4g_firmware","omada_s7500-24y4c_firmware","omada_s7500-26xf6y_firmware","omada_s6500-48mpp6y_firmware","omada_s6500-24mpp4y_firmware","omada_s6500-48gp6xf_firmware","omada_s6500-48g6xf_firmware","omada_s6500-24gp4xf_firmware","omada_s6500-24g4xf_firmware","omada_sx6632yf_firmware","omada_sx3032f_firmware","omada_sx3016f_firmware","omada_sx3008f_firmware","omada_sg3428xf_firmware","omada_sx3832mpp_firmware","omada_sx3832_firmware","omada_sx3206hpp_firmware","omada_sg3428xpp-m2_firmware","omada_sg3428x-m2_firmware","omada_sg3218xp-m2_firmware","omada_sg3210xhp-m2_firmware","omada_sg3210x-m2_firmware","omada_sg2210xmp-m2_firmware","omada_sg6654xhp_firmware","omada_sg6654x_firmware","omada_sg6428xhp_firmware","omada_sg6428x_firmware","omada_sg5452xmpp_firmware","omada_sg5452x_firmware","omada_sg5428xmpp_firmware","omada_sg5428x_firmware","omada_sg3452xmpp_firmware","omada_sg3452xp_firmware","omada_tl-sg3452x_firmware","omada_sg3428xmpp_firmware","omada_sg3428xmp_firmware","omada_sg3428x_firmware","omada_sg2005p-pd_firmware","omada_sg3452p_firmware","omada_sg3452_firmware","omada_sg3428mp_firmware","omada_sg3428_firmware","omada_sg3210_firmware","omada_tl-sg3210_firmware","omada_sg2452lp_firmware","omada_sg2428p_firmware","omada_sg2428lp_firmware","omada_sg2218p_firmware","omada_sg2218_firmware","omada_sg2016p_firmware","omada_sg2210mp_firmware","omada_sg2210p_firmware","omada_sg2008p_firmware","omada_sg2008_firmware","omada_sg2206mp_firmware","omada_es210xpp-m2_firmware","omada_es210x-m2_firmware","omada_es206xpp-m2_firmware","omada_es206x-m2_firmware","omada_es228gmp_firmware","omada_es228gp_firmware","omada_es224g_firmware","omada_es220gp_firmware","omada_es216g_firmware","omada_es210gmp_firmware","omada_es210gp_firmware","omada_es208gp_firmware","omada_es208g_firmware","omada_es206gp_firmware","omada_es205gp_firmware","omada_es205g_firmware","omada_es220gmp_firmware","omada_es1024ge_firmware","omada_ds1016ge_firmware","omada_ds108ge_firmware","omada_ds105ge_firmware","omada_ds1008x_firmware","omada_ds105x_firmware","omada_ds108g-m2_firmware","omada_ds105g-m2_firmware","omada_ds1024g_firmware","omada_ds1016g_firmware","omada_ds110gmp_firmware","omada_ds108g_firmware","omada_ds106gpp_firmware","omada_ds106p_firmware","omada_ds105g_firmware","omada_ds111p_firmware","omada_ds1018gmp_firmware","omada_ds108gp_firmware","omada_ds105gp_firmware"],"published":"2026-08-03","updated":"2026-09-29","sourceUpdated":"2026-09-29T14:10:00.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15631","references":[{"url":"https://www.omadanetworks.com/en/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.omadanetworks.com/us/support/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5216/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd"],"epss":0.00301,"epssPercentile":0.2049,"ingestedAt":"2026-09-29T14:36:14.075Z","slug":"CVE-2025-15631","body":"## Overview\n\nA\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential data may be able to recover valid credentials\nto gain unauthorized access to affected devices or management environments.\n\n## Affected\n\n- `omada_fusion_2.5g_firmware`\n- `omada_er707-m2_firmware`\n- `omada_er7206_firmware`\n- `omada_er706w_firmware`\n- `omada_er8411_firmware`\n- `omada_er605_firmware`\n- `omada_er7412-m2_firmware`\n- `omada_er706w-4g_firmware`\n- `omada_er703wp-4g-outdoor_firmware`\n- `omada_er706wp-4g_firmware`\n- `omada_s7500-24y4c_firmware`\n- `omada_s7500-26xf6y_firmware`\n- `omada_s6500-48mpp6y_firmware`\n- `omada_s6500-24mpp4y_firmware`\n- `omada_s6500-48gp6xf_firmware`\n- `omada_s6500-48g6xf_firmware`\n- `omada_s6500-24gp4xf_firmware`\n- `omada_s6500-24g4xf_firmware`\n- `omada_sx6632yf_firmware`\n- `omada_sx3032f_firmware`\n- `omada_sx3016f_firmware`\n- `omada_sx3008f_firmware`\n- `omada_sg3428xf_firmware`\n- `omada_sx3832mpp_firmware`\n- `omada_sx3832_firmware`\n- `omada_sx3206hpp_firmware`\n- `omada_sg3428xpp-m2_firmware`\n- `omada_sg3428x-m2_firmware`\n- `omada_sg3218xp-m2_firmware`\n- `omada_sg3210xhp-m2_firmware`\n- `omada_sg3210x-m2_firmware`\n- `omada_sg2210xmp-m2_firmware`\n- `omada_sg6654xhp_firmware`\n- `omada_sg6654x_firmware`\n- `omada_sg6428xhp_firmware`\n- `omada_sg6428x_firmware`\n- `omada_sg5452xmpp_firmware`\n- `omada_sg5452x_firmware`\n- `omada_sg5428xmpp_firmware`\n- `omada_sg5428x_firmware`\n- `omada_sg3452xmpp_firmware`\n- `omada_sg3452xp_firmware`\n- `omada_tl-sg3452x_firmware`\n- `omada_sg3428xmpp_firmware`\n- `omada_sg3428xmp_firmware`\n- `omada_sg3428x_firmware`\n- `omada_sg2005p-pd_firmware`\n- `omada_sg3452p_firmware`\n- `omada_sg3452_firmware`\n- `omada_sg3428mp_firmware`\n- `omada_sg3428_firmware`\n- `omada_sg3210_firmware`\n- `omada_tl-sg3210_firmware`\n- `omada_sg2452lp_firmware`\n- `omada_sg2428p_firmware`\n- `omada_sg2428lp_firmware`\n- `omada_sg2218p_firmware`\n- `omada_sg2218_firmware`\n- `omada_sg2016p_firmware`\n- `omada_sg2210mp_firmware`\n- `omada_sg2210p_firmware`\n- `omada_sg2008p_firmware`\n- `omada_sg2008_firmware`\n- `omada_sg2206mp_firmware`\n- `omada_es210xpp-m2_firmware`\n- `omada_es210x-m2_firmware`\n- `omada_es206xpp-m2_firmware`\n- `omada_es206x-m2_firmware`\n- `omada_es228gmp_firmware`\n- `omada_es228gp_firmware`\n- `omada_es224g_firmware`\n- `omada_es220gp_firmware`\n- `omada_es216g_firmware`\n- `omada_es210gmp_firmware`\n- `omada_es210gp_firmware`\n- `omada_es208gp_firmware`\n- `omada_es208g_firmware`\n- `omada_es206gp_firmware`\n- `omada_es205gp_firmware`\n- `omada_es205g_firmware`\n- `omada_es220gmp_firmware`\n- `omada_es1024ge_firmware`\n- `omada_ds1016ge_firmware`\n- `omada_ds108ge_firmware`\n- `omada_ds105ge_firmware`\n- `omada_ds1008x_firmware`\n- `omada_ds105x_firmware`\n- `omada_ds108g-m2_firmware`\n- `omada_ds105g-m2_firmware`\n- `omada_ds1024g_firmware`\n- `omada_ds1016g_firmware`\n- `omada_ds110gmp_firmware`\n- `omada_ds108g_firmware`\n- `omada_ds106gpp_firmware`\n- `omada_ds106p_firmware`\n- `omada_ds105g_firmware`\n- `omada_ds111p_firmware`\n- `omada_ds1018gmp_firmware`\n- `omada_ds108gp_firmware`\n- `omada_ds105gp_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}