Omada Gateways CVE-2025-7851

Exploitation requires the attacker to already have high-privilege/administrative access to the Omada gateway's management interface (CVSS PR:H) and adjacent/local-network reachability to that interface (AV:A) - this is an internet-facing-unauthenticated attack only if admin access is otherwise obtained. The flaw lets such an authenticated operator break out of the device's restricted management shell (the 'restricted conditions' in the description) to obtain a root shell on the underlying OS. Exploitation is further limited by high attack complexity (AC:H) and a required attack condition outside the attacker's control (AT:P), meaning specific device state or configuration must hold. No end-user interaction is required (UI:N). The key limiting factors defenders can rely on are: existing administrative credentials are mandatory, access must be adjacent rather than fully remote, and the exploit is non-trivial - reducing realistic risk well below the raw 8.7 score.

Signals point to a constrained, high-impact privilege-escalation issue rather than a widespread remote threat. The CVSS 4.0 base score of 8.7 is driven almost entirely by total technical impact (VC:H/VI:H/VA:H - a root shell), but the exploitability metrics heavily constrain it: AV:A limits the attacker to the adjacent/local network (not the open internet), PR:H requires the attacker to already hold high-privilege/administrative access on the gateway, and AC:H plus AT:P indicate high attack complexity with attack conditions outside the attacker's control. EPSS is modest at 0.67% (51st percentile), consistent with these preconditions. There is no CISA KEV listing and no public exploit identified at time of analysis - the two strongest real-world-exploitation signals are both absent and agree with the low-to-moderate EPSS. Mapping to an SSVC-style decision: exploitation = none, automatable = no (privileged, adjacent, complex), technical impact = total; this yields a 'Track'/monitor posture rather than 'Act'. Net: this is a genuinely serious post-authentication local root escape for a defense-in-depth model, but it is NOT a drop-everything remote-unauthenticated priority. Note a mild tension to verify with the vendor: the CPE list (FR307-M2, FR205, FR365, G611, G36) is narrower than the much broader Tags list naming many ER-series gateways, so exact affected-model coverage should be confirmed against the Omada advisory.

An attacker who already holds administrative credentials on an Omada business gateway and has adjacent/LAN access to its management interface abuses the improper privilege management flaw to break out of the device's restricted management shell and obtain a full root shell on the underlying operating system. From there they achieve complete device takeover, enabling traffic interception, persistence, and pivoting into the network. No public exploit code was identified at time of analysis, and the high attack complexity plus required admin privileges make opportunistic mass exploitation unlikely.