---
id: CVE-2025-9290
title: >-
  An authentication weakness was identified in Omada Controllers, Gateways and
  Access Points, controller-device adoption due to improper handling of random
  values
summary: >-
  An authentication weakness was identified in Omada Controllers, Gateways and
  Access Points, controller-device adoption due to improper handling of random
  values. Exploitation requires advanced network positioning and allows an
  attacker t…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-760
vendor: tp-link
product: omada_controller
affected:
  - omada_controller < 6.0.0.24
  - omada_controller < 6.0.0.100
  - oc200_firmware < 1.37.9
  - oc220_firmware < 1.1.3
  - oc300_firmware < 1.31.9
  - oc400_firmware < 1.9.9
  - oc200_firmware < 2.22.9
  - oc220_firmware
  - er605_firmware < 2.3.2
  - er7206_firmware < 2.2.2
  - er7406_firmware < 1.2.2
  - er707-m2_firmware < 1.3.1
  - er7412-m2_firmware < 1.1.0
  - er8411_firmware < 1.3.5
  - er706w_firmware < 1.2.1
  - er706w-4g_firmware < 1.2.1
  - er706wp-4g_firmware < 1.1.0
  - er703wp-4g-outdoor_firmware < 1.1.0
  - dr3220v-4g_firmware < 1.1.0
  - dr3650v-4g_firmware < 1.1.0
  - dr3650v_firmware < 1.1.0
  - er701-5g-outdoor_firmware < 1.0.0
  - er605w_firmware < 2.0.2
  - er7212pc_firmware < 2.2.1
  - fr365_firmware < 1.1.10
  - g36w-4g_firmware < 1.1.5
  - eap655-wall_firmware < 1.6.2
  - eap660_hd_firmware < 1.6.1
  - eap620_hd_firmware < 1.6.1
  - eap610-outdoor_firmware < 1.6.1
  - eap610_firmware < 1.6.1
  - eap623-outdoor_hd_firmware < 1.6.1
  - eap625-outdoor_hd_firmware < 1.6.1
  - eap772_firmware < 1.3.2
  - eap772-outdoor_firmware < 1.3.2
  - eap770_firmware < 1.3.2
  - eap723_firmware < 1.3.2
  - eap773_firmware < 1.1.2
  - eap783_firmware < 1.1.2
  - eap772_firmware < 1.1.2
  - eap787_firmware < 1.1.2
  - eap720_firmware < 1.1.2
  - eap723_firmware < 1.1.2
  - eap725-wall_firmware < 1.1.2
  - eap215_bridge_kit_firmware < 1.1.4
  - eap211_bridge_kit_firmware < 1.1.4
  - beam_bridge_5_ur_firmware < 1.1.5
  - eap603gp-desktop_firmware < 1.1.0
  - eap615gp-wall_firmware < 1.1.0
  - eap625gp-wall_firmware < 1.1.0
  - eap610gp-desktop_firmware < 1.1.0
  - eap650gp-desktop_firmware < 1.0.1
  - eap653_firmware < 1.3.3
  - eap650-outdoor_firmware < 1.3.3
  - eap230-wall_firmware < 3.3.1
  - eap235-wall_firmware < 3.3.1
  - eap603-outdoor_firmware < 1.5.1
  - eap653_ur_firmware < 1.4.2
  - eap650-desktop_firmware < 1.1.0
  - eap615-wall_firmware < 1.1.0
  - eap100-bridge_kit_firmware < 1.0.3
  - er706w-4g_firmware < 2.1.0
  - omada_controller < 6.0.0.34
  - omada_controller < 5.15.24
patched:
  - omada_controller 5.15.24
  - oc200_firmware 2.22.9
  - oc220_firmware 1.1.3
  - oc300_firmware 1.31.9
  - oc400_firmware 1.9.9
  - er605_firmware 2.3.2
  - er7206_firmware 2.2.2
  - er7406_firmware 1.2.2
  - er707-m2_firmware 1.3.1
  - er7412-m2_firmware 1.1.0
  - er8411_firmware 1.3.5
  - er706w_firmware 1.2.1
  - er706w-4g_firmware 2.1.0
  - er706wp-4g_firmware 1.1.0
  - er703wp-4g-outdoor_firmware 1.1.0
  - dr3220v-4g_firmware 1.1.0
  - dr3650v-4g_firmware 1.1.0
  - dr3650v_firmware 1.1.0
  - er701-5g-outdoor_firmware 1.0.0
  - er605w_firmware 2.0.2
  - er7212pc_firmware 2.2.1
  - fr365_firmware 1.1.10
  - g36w-4g_firmware 1.1.5
  - eap655-wall_firmware 1.6.2
  - eap660_hd_firmware 1.6.1
  - eap620_hd_firmware 1.6.1
  - eap610-outdoor_firmware 1.6.1
  - eap610_firmware 1.6.1
  - eap623-outdoor_hd_firmware 1.6.1
  - eap625-outdoor_hd_firmware 1.6.1
  - eap772_firmware 1.1.2
  - eap772-outdoor_firmware 1.3.2
  - eap770_firmware 1.3.2
  - eap723_firmware 1.1.2
  - eap773_firmware 1.1.2
  - eap783_firmware 1.1.2
  - eap787_firmware 1.1.2
  - eap720_firmware 1.1.2
  - eap725-wall_firmware 1.1.2
  - eap215_bridge_kit_firmware 1.1.4
  - eap211_bridge_kit_firmware 1.1.4
  - beam_bridge_5_ur_firmware 1.1.5
  - eap603gp-desktop_firmware 1.1.0
  - eap615gp-wall_firmware 1.1.0
  - eap625gp-wall_firmware 1.1.0
  - eap610gp-desktop_firmware 1.1.0
  - eap650gp-desktop_firmware 1.0.1
  - eap653_firmware 1.3.3
  - eap650-outdoor_firmware 1.3.3
  - eap230-wall_firmware 3.3.1
  - eap235-wall_firmware 3.3.1
  - eap603-outdoor_firmware 1.5.1
  - eap653_ur_firmware 1.4.2
  - eap650-desktop_firmware 1.1.0
  - eap615-wall_firmware 1.1.0
  - eap100-bridge_kit_firmware 1.0.3
published: '2026-01-23'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T00:17:19.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-9290'
references:
  - url: 'https://support.omadanetworks.com/en/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://support.omadanetworks.com/us/document/114950/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://support.omadanetworks.com/us/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-23T20:04:16.930287Z'
scores:
  nvd: 5.9
  cna: 6
epss: 0.00225
epssPercentile: 0.12029
ingestedAt: '2026-10-07T00:26:32.088Z'
---

## Overview

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

## Affected

- `omada_controller < 6.0.0.24`
- `omada_controller < 6.0.0.100`
- `oc200_firmware < 1.37.9`
- `oc220_firmware < 1.1.3`
- `oc300_firmware < 1.31.9`
- `oc400_firmware < 1.9.9`
- `oc200_firmware < 2.22.9`
- `oc220_firmware`
- `er605_firmware < 2.3.2`
- `er7206_firmware < 2.2.2`
- `er7406_firmware < 1.2.2`
- `er707-m2_firmware < 1.3.1`
- `er7412-m2_firmware < 1.1.0`
- `er8411_firmware < 1.3.5`
- `er706w_firmware < 1.2.1`
- `er706w-4g_firmware < 1.2.1`
- `er706wp-4g_firmware < 1.1.0`
- `er703wp-4g-outdoor_firmware < 1.1.0`
- `dr3220v-4g_firmware < 1.1.0`
- `dr3650v-4g_firmware < 1.1.0`
- `dr3650v_firmware < 1.1.0`
- `er701-5g-outdoor_firmware < 1.0.0`
- `er605w_firmware < 2.0.2`
- `er7212pc_firmware < 2.2.1`
- `fr365_firmware < 1.1.10`
- `g36w-4g_firmware < 1.1.5`
- `eap655-wall_firmware < 1.6.2`
- `eap660_hd_firmware < 1.6.1`
- `eap620_hd_firmware < 1.6.1`
- `eap610-outdoor_firmware < 1.6.1`
- `eap610_firmware < 1.6.1`
- `eap623-outdoor_hd_firmware < 1.6.1`
- `eap625-outdoor_hd_firmware < 1.6.1`
- `eap772_firmware < 1.3.2`
- `eap772-outdoor_firmware < 1.3.2`
- `eap770_firmware < 1.3.2`
- `eap723_firmware < 1.3.2`
- `eap773_firmware < 1.1.2`
- `eap783_firmware < 1.1.2`
- `eap772_firmware < 1.1.2`
- `eap787_firmware < 1.1.2`
- `eap720_firmware < 1.1.2`
- `eap723_firmware < 1.1.2`
- `eap725-wall_firmware < 1.1.2`
- `eap215_bridge_kit_firmware < 1.1.4`
- `eap211_bridge_kit_firmware < 1.1.4`
- `beam_bridge_5_ur_firmware < 1.1.5`
- `eap603gp-desktop_firmware < 1.1.0`
- `eap615gp-wall_firmware < 1.1.0`
- `eap625gp-wall_firmware < 1.1.0`
- `eap610gp-desktop_firmware < 1.1.0`
- `eap650gp-desktop_firmware < 1.0.1`
- `eap653_firmware < 1.3.3`
- `eap650-outdoor_firmware < 1.3.3`
- `eap230-wall_firmware < 3.3.1`
- `eap235-wall_firmware < 3.3.1`
- `eap603-outdoor_firmware < 1.5.1`
- `eap653_ur_firmware < 1.4.2`
- `eap650-desktop_firmware < 1.1.0`
- `eap615-wall_firmware < 1.1.0`
- `eap100-bridge_kit_firmware < 1.0.3`
- `er706w-4g_firmware < 2.1.0`
- `omada_controller < 6.0.0.34`
- `omada_controller < 5.15.24`

## Remediation

Upgrade past the affected range:

- `omada_controller 5.15.24`
- `oc200_firmware 2.22.9`
- `oc220_firmware 1.1.3`
- `oc300_firmware 1.31.9`
- `oc400_firmware 1.9.9`
- `er605_firmware 2.3.2`
- `er7206_firmware 2.2.2`
- `er7406_firmware 1.2.2`
- `er707-m2_firmware 1.3.1`
- `er7412-m2_firmware 1.1.0`
- `er8411_firmware 1.3.5`
- `er706w_firmware 1.2.1`
- `er706w-4g_firmware 2.1.0`
- `er706wp-4g_firmware 1.1.0`
- `er703wp-4g-outdoor_firmware 1.1.0`
- `dr3220v-4g_firmware 1.1.0`
- `dr3650v-4g_firmware 1.1.0`
- `dr3650v_firmware 1.1.0`
- `er701-5g-outdoor_firmware 1.0.0`
- `er605w_firmware 2.0.2`
- `er7212pc_firmware 2.2.1`
- `fr365_firmware 1.1.10`
- `g36w-4g_firmware 1.1.5`
- `eap655-wall_firmware 1.6.2`
- `eap660_hd_firmware 1.6.1`
- `eap620_hd_firmware 1.6.1`
- `eap610-outdoor_firmware 1.6.1`
- `eap610_firmware 1.6.1`
- `eap623-outdoor_hd_firmware 1.6.1`
- `eap625-outdoor_hd_firmware 1.6.1`
- `eap772_firmware 1.1.2`
- `eap772-outdoor_firmware 1.3.2`
- `eap770_firmware 1.3.2`
- `eap723_firmware 1.1.2`
- `eap773_firmware 1.1.2`
- `eap783_firmware 1.1.2`
- `eap787_firmware 1.1.2`
- `eap720_firmware 1.1.2`
- `eap725-wall_firmware 1.1.2`
- `eap215_bridge_kit_firmware 1.1.4`
- `eap211_bridge_kit_firmware 1.1.4`
- `beam_bridge_5_ur_firmware 1.1.5`
- `eap603gp-desktop_firmware 1.1.0`
- `eap615gp-wall_firmware 1.1.0`
- `eap625gp-wall_firmware 1.1.0`
- `eap610gp-desktop_firmware 1.1.0`
- `eap650gp-desktop_firmware 1.0.1`
- `eap653_firmware 1.3.3`
- `eap650-outdoor_firmware 1.3.3`
- `eap230-wall_firmware 3.3.1`
- `eap235-wall_firmware 3.3.1`
- `eap603-outdoor_firmware 1.5.1`
- `eap653_ur_firmware 1.4.2`
- `eap650-desktop_firmware 1.1.0`
- `eap615-wall_firmware 1.1.0`
- `eap100-bridge_kit_firmware 1.0.3`