Which versions of TP-Link Omada are affected by EUVD-2025-210610?

TP-Link Omada network management infrastructure uses shared embedded certificates across all customer deployments, allowing unauthenticated attackers with network access to impersonate legitimate…. A patch is available.

How to fix or mitigate EUVD-2025-210610?

Within 24 hours, inventory all TP-Link Omada controllers, gateways, switches, access points, and OLTs in your infrastructure and assess whether the management network is accessible from untrusted network segments or the internet. Within 7 days, apply the vendor patch available per TP-Link advisory to all Omada management controllers and managed devices. Within 30 days, complete patch deployment validation across your full Omada deployment, implement network segmentation isolating Omada management traffic from user networks and external access, and log all Omada controller-to-device communications for baseline establishment and anomaly detection.

TP-Link Omada EUVD-2025-210610

Q: What is the CVSS score of EUVD-2025-210610?

EUVD-2025-210610 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-15628 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-03 TPLink

GHSA-8mhg-76f5-54fp

Authentication Bypass Omada Gateways Omada Switches Omada Access Points Omada Controllers Omada Olts

8.2

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.2 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Adjacent vector matches AV:A from 4.0; UI:R reflects passive-but-required device connection initiation; scope change and high confidentiality capture cross-system management traffic interception.

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:01 vuln.today

CVE Published

Aug 03, 2026 - 17:50 cve.org

HIGH 8.2

DescriptionCVE.org

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices.

An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

AnalysisAI

Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.

Technical ContextAI

CWE-798 (Use of Hard-coded Credentials) describes the root cause: TP-Link embedded identical certificates into firmware shipped across all Omada product families rather than issuing per-device or per-deployment certificates. The Omada ecosystem uses a controller-to-device trust model where controllers manage gateways, switches, access points, and OLTs; this trust is validated via the embedded certificates. Because the same certificate material is present in every unit shipped, extraction from a single device - via firmware unpacking or device compromise - yields a credential that is valid against every other Omada deployment globally. Affected CPEs span the full product stack: cpe:2.3:a:tp-link_systems_inc.:omada_gateways, omada_switches, omada_access_points, omada_controllers, and omada_olts, all with wildcard version strings indicating the issue is not constrained to a specific firmware branch.

RemediationAI

The vendor has released a patch; administrators should immediately download updated firmware for all affected Omada product types (gateways, switches, access points, controllers, and OLTs) from https://www.omadanetworks.com/us/support/download/ and consult the TP-Link advisory at https://www.tp-link.com/us/support/faq/5216/ for product-specific fix versions and update sequencing guidance. An exact patched firmware version was not independently enumerated in the available input data, so administrators must verify the minimum acceptable version directly from the advisory before deploying. As a compensating control prior to patching, isolate the Omada management network on a dedicated VLAN with strict ACLs permitting only known controller-to-device communication paths, and block lateral access from untrusted segments; this raises the bar for the AV:A prerequisite but does not eliminate the vulnerability since insider or compromised-host attackers may still satisfy the adjacency condition. Monitoring for unexpected devices presenting Omada controller certificates on the management plane can serve as a detection signal.