CVE-2025-15544: fallo de gravedad media en TP Link Systems Inc. Omada Access Points
Weak Credential Protection During TP-Link Omada Device Adoption
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.3%
A cryptographic
weakness exists in the Omada device adoption process. During adoption, authentication credentials associated
with site management are transmitted using a weak hashing algorithm that does
not provide sufficient protection.
An attacker who
successfully intercepts adoption-related authentication traffic may be able to
recover valid credentials and gain unauthorized access to managed devices or
controller-managed environments.
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
TP Link Systems Inc. · Omada Access PointsTP-Link Systems Inc · Omada ControllersTP-Link Systems Inc · Omada OLTsTP-Link Systems Inc. · Omada AppTP-Link Systems Inc. · Omada GatewaysTP-Link Systems Inc. · Omada SwitchesCVEs relacionadas — TP Link Systems Inc. Omada Access Points
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.7%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2025-15630MEDIUMDevice Provisioning Race Condition in TP-Link Omada Adoption WorkflowEPSS 0.3%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.3%