{"id":"CVE-2025-9291","title":"A\ncertification validation weakness exists in communication between affected\nOmada devices and cloud controllers","summary":"A\ncertification validation weakness exists in communication between affected\nOmada devices and cloud controllers. Certificate identity verification does not\nadequately validate that a presented certificate corresponds to the expected\nclo…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-295"],"vendor":"tp-link","product":"omada_fusion_2.5g_firmware","affected":["omada_fusion_2.5g_firmware","omada_er707-m2_firmware","omada_er7206_firmware","omada_er706w_firmware","omada_er8411_firmware","omada_er605_firmware","omada_er7412-m2_firmware","omada_er706w-4g_firmware","omada_er703wp-4g-outdoor_firmware","omada_er706wp-4g_firmware","omada_s7500-24y4c_firmware","omada_s7500-26xf6y_firmware","omada_s6500-48mpp6y_firmware","omada_s6500-24mpp4y_firmware","omada_s6500-48gp6xf_firmware","omada_s6500-48g6xf_firmware","omada_s6500-24gp4xf_firmware","omada_s6500-24g4xf_firmware","omada_sx6632yf_firmware","omada_sx3032f_firmware","omada_sx3016f_firmware","omada_sx3008f_firmware","omada_sg3428xf_firmware","omada_sx3832mpp_firmware","omada_sx3832_firmware","omada_sx3206hpp_firmware","omada_sg3428xpp-m2_firmware","omada_sg3428x-m2_firmware","omada_sg3218xp-m2_firmware","omada_sg3210xhp-m2_firmware","omada_sg3210x-m2_firmware","omada_sg2210xmp-m2_firmware","omada_sg6654xhp_firmware","omada_sg6654x_firmware","omada_sg6428xhp_firmware","omada_sg6428x_firmware","omada_sg5452xmpp_firmware","omada_sg5452x_firmware","omada_sg5428xmpp_firmware","omada_sg5428x_firmware","omada_sg3452xmpp_firmware","omada_sg3452xp_firmware","omada_tl-sg3452x_firmware","omada_sg3428xmpp_firmware","omada_sg3428xmp_firmware","omada_sg3428x_firmware","omada_sg2005p-pd_firmware","omada_sg3452p_firmware","omada_sg3452_firmware","omada_sg3428mp_firmware","omada_sg3428_firmware","omada_sg3210_firmware","omada_tl-sg3210_firmware","omada_sg2452lp_firmware","omada_sg2428p_firmware","omada_sg2428lp_firmware","omada_sg2218p_firmware","omada_sg2218_firmware","omada_sg2016p_firmware","omada_sg2210mp_firmware","omada_sg2210p_firmware","omada_sg2008p_firmware","omada_sg2008_firmware","omada_sg2206mp_firmware","omada_es210xpp-m2_firmware","omada_es210x-m2_firmware","omada_es206xpp-m2_firmware","omada_es206x-m2_firmware","omada_es228gmp_firmware","omada_es228gp_firmware","omada_es224g_firmware","omada_es220gp_firmware","omada_es216g_firmware","omada_es210gmp_firmware","omada_es210gp_firmware","omada_es208gp_firmware","omada_es208g_firmware","omada_es206gp_firmware","omada_es205gp_firmware","omada_es205g_firmware","omada_es220gmp_firmware","omada_es1024ge_firmware","omada_ds1016ge_firmware","omada_ds108ge_firmware","omada_ds105ge_firmware","omada_ds1008x_firmware","omada_ds105x_firmware","omada_ds108g-m2_firmware","omada_ds105g-m2_firmware","omada_ds1024g_firmware","omada_ds1016g_firmware","omada_ds110gmp_firmware","omada_ds108g_firmware","omada_ds106gpp_firmware","omada_ds106p_firmware","omada_ds105g_firmware","omada_ds111p_firmware","omada_ds1018gmp_firmware","omada_ds108gp_firmware","omada_ds105gp_firmware"],"published":"2026-08-03","updated":"2026-09-29","sourceUpdated":"2026-09-29T14:10:00.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9291","references":[{"url":"https://support.omadanetworks.com/en/download/firmware/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/download/firmware/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5216/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd"],"epss":0.00216,"epssPercentile":0.1081,"ingestedAt":"2026-09-29T14:36:14.073Z","slug":"CVE-2025-9291","body":"## Overview\n\nA\ncertification validation weakness exists in communication between affected\nOmada devices and cloud controllers. Certificate identity verification does not\nadequately validate that a presented certificate corresponds to the expected\ncloud controller hostname, which may allow certificate validation protections\nto be bypassed under specific conditions.\n\n\n\n\n\nSuccessful\nexploitation may allow interception or modification of communication between\naffected devices and cloud controllers.\n\n## Affected\n\n- `omada_fusion_2.5g_firmware`\n- `omada_er707-m2_firmware`\n- `omada_er7206_firmware`\n- `omada_er706w_firmware`\n- `omada_er8411_firmware`\n- `omada_er605_firmware`\n- `omada_er7412-m2_firmware`\n- `omada_er706w-4g_firmware`\n- `omada_er703wp-4g-outdoor_firmware`\n- `omada_er706wp-4g_firmware`\n- `omada_s7500-24y4c_firmware`\n- `omada_s7500-26xf6y_firmware`\n- `omada_s6500-48mpp6y_firmware`\n- `omada_s6500-24mpp4y_firmware`\n- `omada_s6500-48gp6xf_firmware`\n- `omada_s6500-48g6xf_firmware`\n- `omada_s6500-24gp4xf_firmware`\n- `omada_s6500-24g4xf_firmware`\n- `omada_sx6632yf_firmware`\n- `omada_sx3032f_firmware`\n- `omada_sx3016f_firmware`\n- `omada_sx3008f_firmware`\n- `omada_sg3428xf_firmware`\n- `omada_sx3832mpp_firmware`\n- `omada_sx3832_firmware`\n- `omada_sx3206hpp_firmware`\n- `omada_sg3428xpp-m2_firmware`\n- `omada_sg3428x-m2_firmware`\n- `omada_sg3218xp-m2_firmware`\n- `omada_sg3210xhp-m2_firmware`\n- `omada_sg3210x-m2_firmware`\n- `omada_sg2210xmp-m2_firmware`\n- `omada_sg6654xhp_firmware`\n- `omada_sg6654x_firmware`\n- `omada_sg6428xhp_firmware`\n- `omada_sg6428x_firmware`\n- `omada_sg5452xmpp_firmware`\n- `omada_sg5452x_firmware`\n- `omada_sg5428xmpp_firmware`\n- `omada_sg5428x_firmware`\n- `omada_sg3452xmpp_firmware`\n- `omada_sg3452xp_firmware`\n- `omada_tl-sg3452x_firmware`\n- `omada_sg3428xmpp_firmware`\n- `omada_sg3428xmp_firmware`\n- `omada_sg3428x_firmware`\n- `omada_sg2005p-pd_firmware`\n- `omada_sg3452p_firmware`\n- `omada_sg3452_firmware`\n- `omada_sg3428mp_firmware`\n- `omada_sg3428_firmware`\n- `omada_sg3210_firmware`\n- `omada_tl-sg3210_firmware`\n- `omada_sg2452lp_firmware`\n- `omada_sg2428p_firmware`\n- `omada_sg2428lp_firmware`\n- `omada_sg2218p_firmware`\n- `omada_sg2218_firmware`\n- `omada_sg2016p_firmware`\n- `omada_sg2210mp_firmware`\n- `omada_sg2210p_firmware`\n- `omada_sg2008p_firmware`\n- `omada_sg2008_firmware`\n- `omada_sg2206mp_firmware`\n- `omada_es210xpp-m2_firmware`\n- `omada_es210x-m2_firmware`\n- `omada_es206xpp-m2_firmware`\n- `omada_es206x-m2_firmware`\n- `omada_es228gmp_firmware`\n- `omada_es228gp_firmware`\n- `omada_es224g_firmware`\n- `omada_es220gp_firmware`\n- `omada_es216g_firmware`\n- `omada_es210gmp_firmware`\n- `omada_es210gp_firmware`\n- `omada_es208gp_firmware`\n- `omada_es208g_firmware`\n- `omada_es206gp_firmware`\n- `omada_es205gp_firmware`\n- `omada_es205g_firmware`\n- `omada_es220gmp_firmware`\n- `omada_es1024ge_firmware`\n- `omada_ds1016ge_firmware`\n- `omada_ds108ge_firmware`\n- `omada_ds105ge_firmware`\n- `omada_ds1008x_firmware`\n- `omada_ds105x_firmware`\n- `omada_ds108g-m2_firmware`\n- `omada_ds105g-m2_firmware`\n- `omada_ds1024g_firmware`\n- `omada_ds1016g_firmware`\n- `omada_ds110gmp_firmware`\n- `omada_ds108g_firmware`\n- `omada_ds106gpp_firmware`\n- `omada_ds106p_firmware`\n- `omada_ds105g_firmware`\n- `omada_ds111p_firmware`\n- `omada_ds1018gmp_firmware`\n- `omada_ds108gp_firmware`\n- `omada_ds105gp_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}