Is there a patch available for CVE-2025-15631?

Yes, a patch is available for CVE-2025-15631. Update the affected software to the latest version immediately.

TP-Link Omada CVE-2025-15631

Q: What is the CVSS score of CVE-2025-15631?

CVE-2025-15631 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210613 MEDIUM

Use of a One-Way Hash without a Salt (CWE-759)

2026-08-03 TPLink

GHSA-gq9r-pf66-hjcm

Authentication Bypass Omada Gateways Omada Switches Omada Access Points Omada Olts Tp Link Systems Inc

5.7

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Adjacent access and high privileges required to read stored hashes; sole impact is credential confidentiality with no integrity or availability consequence.

3.1 AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:05 vuln.today

DescriptionCVE.org

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection.

An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

AnalysisAI

Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.

Technical ContextAI

CWE-759 (Use of a One-Way Hash without a Salt) identifies the root cause: the Omada firmware applies a legacy hashing function to site credentials without a per-credential salt. Unsalted hashes are vulnerable to precomputed attacks such as rainbow tables, or to efficient offline brute-force if the algorithm is computationally inexpensive (e.g., MD5, SHA-1). TP-Link's Omada SDN platform spans four device classes per CPE data - cpe:2.3:a:tp-link_systems_inc.:omada_gateways, omada_switches, omada_access_points, and omada_olts - all confirmed affected across wildcard version ranges, meaning version-specific scoping has not been provided by the vendor. The credential storage vulnerability exists within the Omada controller or on-device management plane rather than in transit.

RemediationAI

Apply the vendor-released firmware update for all affected Omada device classes (Gateways, Switches, Access Points, OLTs) as the primary remediation. Updated firmware is available from the Omada firmware download portals at https://www.omadanetworks.com/us/support/download/ and https://www.omadanetworks.com/en/support/download/, with the advisory at https://www.tp-link.com/us/support/faq/5216/ providing device-specific guidance. Exact patched firmware version numbers were not independently confirmed in the available data - retrieve these from the vendor advisory directly. As a compensating control prior to patching, restrict administrative access to the Omada controller and device management interfaces to trusted hosts only, using firewall ACLs or VLAN segmentation to limit adjacency; this reduces the AV:A attack surface. After applying the patch, force rotation of all site credentials to invalidate any previously stored hashes that may have been exposed. Audit access logs for unexpected authentication events that could indicate prior credential recovery.