Which versions of TP-Link Omada are affected by CVE-2025-9291?

TP-Link Omada networking devices contain a certificate validation vulnerability that enables network-positioned attackers to intercept or modify management traffic between devices and cloud…. A patch is available.

How to fix or mitigate CVE-2025-9291?

Within 24 hours, inventory all TP-Link Omada devices across your infrastructure and identify current firmware versions; cross-reference with TP-Link's security advisory to determine which devices require patching. Within 7 days, obtain the patched firmware from TP-Link and deploy updates to all affected devices in your change management process, prioritizing management-critical devices. Within 30 days, complete patching across the entire fleet and validate restoration of secure management traffic through operational monitoring and firmware version audits.

TP-Link Omada CVE-2025-9291

Q: What is the CVSS score of CVE-2025-9291?

CVE-2025-9291 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210607 HIGH

Improper Certificate Validation (CWE-295)

2026-08-03 TPLink

GHSA-7qrm-8hrr-59qj

Authentication Bypass Omada Gateways Omada Switches Omada Access Points

7.7

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network vector with high complexity for MitM positioning; no privileges required; user interaction needed to trigger handshake; no standalone availability impact from certificate bypass.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:16 vuln.today

CVE Published

Aug 03, 2026 - 17:48 cve.org

HIGH 7.7

DescriptionCVE.org

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions.

Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

AnalysisAI

Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) allows a network-positioned attacker to intercept or modify encrypted management traffic between those devices and their cloud controllers. The flaw - classified as CWE-295 - means the devices do not adequately confirm that a presented TLS certificate belongs to the expected cloud controller hostname, enabling a machine-in-the-middle to substitute a fraudulent certificate and break the trust boundary. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor has released patched firmware.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes a class of flaws where a TLS client accepts a certificate without fully verifying its identity - typically by skipping or weakening the hostname/SAN matching step. In this case, Omada devices establishing TLS sessions with cloud controllers do not rigorously assert that the certificate's Subject Alternative Name or Common Name corresponds to the expected cloud controller FQDN. This means a certificate that is cryptographically valid (e.g., issued by a trusted CA for a different domain) can satisfy the device's validation logic. The vulnerability exists across the entire Omada networking product line: gateways, switches, and access points, as captured in CPE strings cpe:2.3:a:tp-link_systems_inc.:omada_gateways:*:*:*:*:*:*:*:*, cpe:2.3:a:tp-link_systems_inc.:omada_switches:*:*:*:*:*:*:*:*, and cpe:2.3:a:tp-link_systems_inc.:omada_access_points:*:*:*:*:*:*:*:*. The affected communication channel is the device-to-cloud-controller management plane, not device data-plane traffic.

RemediationAI

The primary fix is upgrading affected device firmware to the patched versions published by TP-Link at the Omada firmware download portal (https://support.omadanetworks.com/en/download/firmware/ or the US mirror at https://support.omadanetworks.com/us/download/firmware/). Per the vendor advisory at https://www.tp-link.com/us/support/faq/5216/, firmware updates are the definitive remediation; specific minimum patched firmware version numbers per model should be confirmed against that advisory, as wildcard CPE data does not enumerate them. Patch availability is confirmed per vendor reporting; released patched version numbers are not independently verified in the available reference data. As a compensating control where immediate firmware upgrade is not feasible, restrict outbound routing from Omada devices so they can only reach legitimate TP-Link cloud controller IP ranges, reducing the attacker's ability to redirect or intercept cloud-bound TLS sessions - note this does not fix the certificate validation flaw and will not protect against a MitM already on the authorized path. Alternatively, deploy Omada devices in self-hosted software controller mode rather than cloud controller mode to eliminate the cloud-to-device TLS trust dependency entirely, though this changes the operational management model.