CVE-2025-15544mediumCWE-759

CVE-2025-15544: medium-severity vulnerability in TP Link Systems Inc. Omada Access Points

Weak Credential Protection During TP-Link Omada Device Adoption

Published

Follow this CVE+ Monitor Omada Gateways+ Monitor Omada Access Points

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
TP Link Systems Inc. · Omada Access PointsTP-Link Systems Inc · Omada ControllersTP-Link Systems Inc · Omada OLTsTP-Link Systems Inc. · Omada AppTP-Link Systems Inc. · Omada GatewaysTP-Link Systems Inc. · Omada Switches
Related CVEs — TP Link Systems Inc. Omada Access Points

In the same product, most dangerous first.

CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.7%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2025-15630MEDIUMDevice Provisioning Race Condition in TP-Link Omada Adoption WorkflowEPSS 0.3%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.3%