What is the CVSS score of CVE-2025-9290?

CVE-2025-9290 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-9290?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Beam Bridge 5 Ur Firmware CVE-2025-9290

MEDIUM

Use of a One-Way Hash with a Predictable Salt (CWE-760)

2026-01-23 f23511db-6c3e-4e32-a477-6aa17d310630

Information Disclosure TP-Link Beam Bridge 5 Ur Firmware Dr3220v 4g Firmware Dr3650v 4g Firmware Dr3650v Firmware Eap100 Bridge Kit Firmware Eap211 Bridge Kit Firmware Eap215 Bridge Kit Firmware Eap230 Wall Firmware Eap235 Wall Firmware Eap603 Outdoor Firmware Eap603gp Desktop Firmware Eap610 Firmware Eap610 Outdoor Firmware Eap610gp Desktop Firmware Eap615 Wall Firmware Eap615gp Wall Firmware Eap620 Hd Firmware Eap623 Outdoor Hd Firmware Eap625 Outdoor Hd Firmware Eap625gp Wall Firmware Eap650 Desktop Firmware Eap650 Outdoor Firmware Eap650gp Desktop Firmware Eap653 Firmware Eap653 Ur Firmware Eap655 Wall Firmware Eap660 Hd Firmware Eap720 Firmware Eap723 Firmware Eap725 Wall Firmware Eap770 Firmware Eap772 Firmware Eap772 Outdoor Firmware Eap773 Firmware Eap783 Firmware Eap787 Firmware Er605 Firmware Er605w Firmware Er701 5g Outdoor Firmware Er703wp 4g Outdoor Firmware Er706w 4g Firmware Er706w Firmware Er706wp 4g Firmware Er707 M2 Firmware Er7206 Firmware Er7212pc Firmware Er7406 Firmware Er7412 M2 Firmware Er8411 Firmware Fr365 Firmware G36w 4g Firmware Oc200 Firmware Oc220 Firmware Oc300 Firmware Oc400 Firmware Omada Controller

6.0

CVSS 4.0 · Vendor: f23511db-6c3e-4e32-a477-6aa17d310630

View

Vulnerability Assessment

Weakness	CWE CWE-760 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Unpredictable hash salts
Impact	Exploitable via remote/network.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to intercept adoption traffic and forge valid authentication through offline precom.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values.

RemediationAI

Monitor vendor advisories for a patch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Know when Beam Bridge 5 Ur Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) PRIMARY 6.0 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) · only source for this CVE.

CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630

Attack Vector

Adjacent

Attack Complexity

High

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Oct 07, 2026 - 00:22 NVD

5.9 (MEDIUM) 6.0 (MEDIUM)

CVE Published

Jan 23, 2026 - 00:15 nvd

MEDIUM 5.9

DescriptionCVE.org

Executive ViewAI

Why It Matters

Organizations using An authentication weakness should be aware of moderate risk from CVE-2025-9290 rated CVSS 5.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Controlled

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +30

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.