---
id: CVE-2025-9291
title: |-
  A
  certification validation weakness exists in communication between affected
  Omada devices and cloud controllers
summary: >-
  A

  certification validation weakness exists in communication between affected

  Omada devices and cloud controllers. Certificate identity verification does
  not

  adequately validate that a presented certificate corresponds to the expected

  clo…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-295
vendor: tp-link
product: omada_fusion_2.5g_firmware
affected:
  - omada_fusion_2.5g_firmware
  - omada_er707-m2_firmware
  - omada_er7206_firmware
  - omada_er706w_firmware
  - omada_er8411_firmware
  - omada_er605_firmware
  - omada_er7412-m2_firmware
  - omada_er706w-4g_firmware
  - omada_er703wp-4g-outdoor_firmware
  - omada_er706wp-4g_firmware
  - omada_s7500-24y4c_firmware
  - omada_s7500-26xf6y_firmware
  - omada_s6500-48mpp6y_firmware
  - omada_s6500-24mpp4y_firmware
  - omada_s6500-48gp6xf_firmware
  - omada_s6500-48g6xf_firmware
  - omada_s6500-24gp4xf_firmware
  - omada_s6500-24g4xf_firmware
  - omada_sx6632yf_firmware
  - omada_sx3032f_firmware
  - omada_sx3016f_firmware
  - omada_sx3008f_firmware
  - omada_sg3428xf_firmware
  - omada_sx3832mpp_firmware
  - omada_sx3832_firmware
  - omada_sx3206hpp_firmware
  - omada_sg3428xpp-m2_firmware
  - omada_sg3428x-m2_firmware
  - omada_sg3218xp-m2_firmware
  - omada_sg3210xhp-m2_firmware
  - omada_sg3210x-m2_firmware
  - omada_sg2210xmp-m2_firmware
  - omada_sg6654xhp_firmware
  - omada_sg6654x_firmware
  - omada_sg6428xhp_firmware
  - omada_sg6428x_firmware
  - omada_sg5452xmpp_firmware
  - omada_sg5452x_firmware
  - omada_sg5428xmpp_firmware
  - omada_sg5428x_firmware
  - omada_sg3452xmpp_firmware
  - omada_sg3452xp_firmware
  - omada_tl-sg3452x_firmware
  - omada_sg3428xmpp_firmware
  - omada_sg3428xmp_firmware
  - omada_sg3428x_firmware
  - omada_sg2005p-pd_firmware
  - omada_sg3452p_firmware
  - omada_sg3452_firmware
  - omada_sg3428mp_firmware
  - omada_sg3428_firmware
  - omada_sg3210_firmware
  - omada_tl-sg3210_firmware
  - omada_sg2452lp_firmware
  - omada_sg2428p_firmware
  - omada_sg2428lp_firmware
  - omada_sg2218p_firmware
  - omada_sg2218_firmware
  - omada_sg2016p_firmware
  - omada_sg2210mp_firmware
  - omada_sg2210p_firmware
  - omada_sg2008p_firmware
  - omada_sg2008_firmware
  - omada_sg2206mp_firmware
  - omada_es210xpp-m2_firmware
  - omada_es210x-m2_firmware
  - omada_es206xpp-m2_firmware
  - omada_es206x-m2_firmware
  - omada_es228gmp_firmware
  - omada_es228gp_firmware
  - omada_es224g_firmware
  - omada_es220gp_firmware
  - omada_es216g_firmware
  - omada_es210gmp_firmware
  - omada_es210gp_firmware
  - omada_es208gp_firmware
  - omada_es208g_firmware
  - omada_es206gp_firmware
  - omada_es205gp_firmware
  - omada_es205g_firmware
  - omada_es220gmp_firmware
  - omada_es1024ge_firmware
  - omada_ds1016ge_firmware
  - omada_ds108ge_firmware
  - omada_ds105ge_firmware
  - omada_ds1008x_firmware
  - omada_ds105x_firmware
  - omada_ds108g-m2_firmware
  - omada_ds105g-m2_firmware
  - omada_ds1024g_firmware
  - omada_ds1016g_firmware
  - omada_ds110gmp_firmware
  - omada_ds108g_firmware
  - omada_ds106gpp_firmware
  - omada_ds106p_firmware
  - omada_ds105g_firmware
  - omada_ds111p_firmware
  - omada_ds1018gmp_firmware
  - omada_ds108gp_firmware
  - omada_ds105gp_firmware
published: '2026-08-03'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T14:10:00.117'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-9291'
references:
  - url: 'https://support.omadanetworks.com/en/download/firmware/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://support.omadanetworks.com/us/download/firmware/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5216/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
epss: 0.00216
epssPercentile: 0.1081
ingestedAt: '2026-09-29T14:36:14.073Z'
---

## Overview

A
certification validation weakness exists in communication between affected
Omada devices and cloud controllers. Certificate identity verification does not
adequately validate that a presented certificate corresponds to the expected
cloud controller hostname, which may allow certificate validation protections
to be bypassed under specific conditions.





Successful
exploitation may allow interception or modification of communication between
affected devices and cloud controllers.

## Affected

- `omada_fusion_2.5g_firmware`
- `omada_er707-m2_firmware`
- `omada_er7206_firmware`
- `omada_er706w_firmware`
- `omada_er8411_firmware`
- `omada_er605_firmware`
- `omada_er7412-m2_firmware`
- `omada_er706w-4g_firmware`
- `omada_er703wp-4g-outdoor_firmware`
- `omada_er706wp-4g_firmware`
- `omada_s7500-24y4c_firmware`
- `omada_s7500-26xf6y_firmware`
- `omada_s6500-48mpp6y_firmware`
- `omada_s6500-24mpp4y_firmware`
- `omada_s6500-48gp6xf_firmware`
- `omada_s6500-48g6xf_firmware`
- `omada_s6500-24gp4xf_firmware`
- `omada_s6500-24g4xf_firmware`
- `omada_sx6632yf_firmware`
- `omada_sx3032f_firmware`
- `omada_sx3016f_firmware`
- `omada_sx3008f_firmware`
- `omada_sg3428xf_firmware`
- `omada_sx3832mpp_firmware`
- `omada_sx3832_firmware`
- `omada_sx3206hpp_firmware`
- `omada_sg3428xpp-m2_firmware`
- `omada_sg3428x-m2_firmware`
- `omada_sg3218xp-m2_firmware`
- `omada_sg3210xhp-m2_firmware`
- `omada_sg3210x-m2_firmware`
- `omada_sg2210xmp-m2_firmware`
- `omada_sg6654xhp_firmware`
- `omada_sg6654x_firmware`
- `omada_sg6428xhp_firmware`
- `omada_sg6428x_firmware`
- `omada_sg5452xmpp_firmware`
- `omada_sg5452x_firmware`
- `omada_sg5428xmpp_firmware`
- `omada_sg5428x_firmware`
- `omada_sg3452xmpp_firmware`
- `omada_sg3452xp_firmware`
- `omada_tl-sg3452x_firmware`
- `omada_sg3428xmpp_firmware`
- `omada_sg3428xmp_firmware`
- `omada_sg3428x_firmware`
- `omada_sg2005p-pd_firmware`
- `omada_sg3452p_firmware`
- `omada_sg3452_firmware`
- `omada_sg3428mp_firmware`
- `omada_sg3428_firmware`
- `omada_sg3210_firmware`
- `omada_tl-sg3210_firmware`
- `omada_sg2452lp_firmware`
- `omada_sg2428p_firmware`
- `omada_sg2428lp_firmware`
- `omada_sg2218p_firmware`
- `omada_sg2218_firmware`
- `omada_sg2016p_firmware`
- `omada_sg2210mp_firmware`
- `omada_sg2210p_firmware`
- `omada_sg2008p_firmware`
- `omada_sg2008_firmware`
- `omada_sg2206mp_firmware`
- `omada_es210xpp-m2_firmware`
- `omada_es210x-m2_firmware`
- `omada_es206xpp-m2_firmware`
- `omada_es206x-m2_firmware`
- `omada_es228gmp_firmware`
- `omada_es228gp_firmware`
- `omada_es224g_firmware`
- `omada_es220gp_firmware`
- `omada_es216g_firmware`
- `omada_es210gmp_firmware`
- `omada_es210gp_firmware`
- `omada_es208gp_firmware`
- `omada_es208g_firmware`
- `omada_es206gp_firmware`
- `omada_es205gp_firmware`
- `omada_es205g_firmware`
- `omada_es220gmp_firmware`
- `omada_es1024ge_firmware`
- `omada_ds1016ge_firmware`
- `omada_ds108ge_firmware`
- `omada_ds105ge_firmware`
- `omada_ds1008x_firmware`
- `omada_ds105x_firmware`
- `omada_ds108g-m2_firmware`
- `omada_ds105g-m2_firmware`
- `omada_ds1024g_firmware`
- `omada_ds1016g_firmware`
- `omada_ds110gmp_firmware`
- `omada_ds108g_firmware`
- `omada_ds106gpp_firmware`
- `omada_ds106p_firmware`
- `omada_ds105g_firmware`
- `omada_ds111p_firmware`
- `omada_ds1018gmp_firmware`
- `omada_ds108gp_firmware`
- `omada_ds105gp_firmware`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.