CVE-2025-15627: fallo de gravedad media en TP Link Systems Inc. Omada Access Points
Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.7%
A cryptographic
weakness exists in the Omada adoption protocol.
The protocol relies on hard-coded cryptographic keys to establish trust and
protect authentication exchanges between controllers and managed devices during
device adoption.
An attacker may
be able to impersonate trusted controllers or managed devices and gain access
to sensitive adoption-related communications.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
TP Link Systems Inc. · Omada Access PointsTP-Link Systems Inc · Omada ControllersTP-Link Systems Inc. · Omada GatewaysTP-Link Systems Inc. · Omada SwitchesCVEs relacionadas — TP Link Systems Inc. Omada Access Points
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-15544MEDIUMWeak Credential Protection During TP-Link Omada Device AdoptionEPSS 0.3%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2025-15630MEDIUMDevice Provisioning Race Condition in TP-Link Omada Adoption WorkflowEPSS 0.3%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.3%CVE-2025-9291HIGHImproper Certificate Validation in TP-Link Omada Cloud CommunicationsEPSS 0.2%