EUVD-2025-210608
GHSA-9469-xx96-p5v2
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent attack vector and user interaction (adoption event required); scope change reflects credential access granting control over managed infrastructure beyond initial intercept target.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection.
An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.
AnalysisAI
Credential interception in TP-Link Omada's device adoption process exposes site management authentication to offline cracking due to use of a weak, unsalted hash algorithm (CWE-759). An adjacent-network attacker who captures adoption-phase traffic can recover plaintext credentials and authenticate to the Omada controller or managed devices including gateways, switches, access points, and OLTs. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS 4.0 score of 6.9 reflects meaningful real-world constraints including network adjacency, high attack complexity, and a required adoption event.
Technical ContextAI
The TP-Link Omada SDN platform operates a centralized controller that manages a fleet of networking devices - gateways, switches, access points, OLTs, and the Omada App - through an adoption workflow that brings new devices under controller authority. During this adoption handshake, site management authentication credentials are transmitted protected only by an unsalted one-way hash, the exact weakness defined by CWE-759 (Use of a One-Way Hash without a Salt). Without a per-credential salt, the hashes are deterministic and susceptible to precomputation attacks such as rainbow table lookups, dramatically reducing the cost of offline cracking compared to properly salted schemes. Affected CPEs span all Omada product lines (cpe:2.3:a:tp-link_systems_inc.:omada_gateways, omada_switches, omada_access_points, omada_app, omada_controllers, omada_olts) with wildcard version ranges, indicating the issue pervades the platform broadly.
RemediationAI
Apply the vendor-released patch per the TP-Link advisory at https://www.tp-link.com/us/support/faq/5216/; firmware and software downloads are provided at https://www.omadanetworks.com/us/support/download/ and https://www.omadanetworks.com/en/support/download/. Exact patched version numbers are not independently confirmed in available data - consult the advisory for per-product fix versions. As a compensating control prior to patching, isolate the Omada management network on a dedicated, access-controlled VLAN to eliminate network adjacency for untrusted parties; this removes the attacker's ability to capture adoption traffic but requires ongoing VLAN discipline. Perform device adoption events only from trusted, monitored endpoints on the management segment, minimizing the window of exposure. If adoption traffic may have transited untrusted segments historically, rotate all site management credentials used in the Omada controller immediately, as previously intercepted hashes could be cracked offline at any time.
More in Omada Gateways
View allShared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and manage
Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) all
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate tru
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-t
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network a
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs
Same weakness CWE-759 – Use of a One-Way Hash without a Salt
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today