Omada Gateways
Monthly
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-to-device communications to decryption by adjacent network attackers. The adoption protocol - the handshake sequence by which Omada Controllers onboard and establish management sessions with gateways, switches, and access points - generates session encryption keys with insufficient randomness, making them potentially recoverable through cryptanalytic means after traffic interception. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 and the high confidentiality impact on both the vulnerable and subsequent systems indicate meaningful confidentiality risk for organizations relying on Omada-managed network infrastructure.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.
Credential interception in TP-Link Omada's device adoption process exposes site management authentication to offline cracking due to use of a weak, unsalted hash algorithm (CWE-759). An adjacent-network attacker who captures adoption-phase traffic can recover plaintext credentials and authenticate to the Omada controller or managed devices including gateways, switches, access points, and OLTs. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS 4.0 score of 6.9 reflects meaningful real-world constraints including network adjacency, high attack complexity, and a required adoption event.
Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) allows a network-positioned attacker to intercept or modify encrypted management traffic between those devices and their cloud controllers. The flaw - classified as CWE-295 - means the devices do not adequately confirm that a presented TLS certificate belongs to the expected cloud controller hostname, enabling a machine-in-the-middle to substitute a fraudulent certificate and break the trust boundary. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor has released patched firmware.
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-to-device communications to decryption by adjacent network attackers. The adoption protocol - the handshake sequence by which Omada Controllers onboard and establish management sessions with gateways, switches, and access points - generates session encryption keys with insufficient randomness, making them potentially recoverable through cryptanalytic means after traffic interception. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 and the high confidentiality impact on both the vulnerable and subsequent systems indicate meaningful confidentiality risk for organizations relying on Omada-managed network infrastructure.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.
Credential interception in TP-Link Omada's device adoption process exposes site management authentication to offline cracking due to use of a weak, unsalted hash algorithm (CWE-759). An adjacent-network attacker who captures adoption-phase traffic can recover plaintext credentials and authenticate to the Omada controller or managed devices including gateways, switches, access points, and OLTs. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS 4.0 score of 6.9 reflects meaningful real-world constraints including network adjacency, high attack complexity, and a required adoption event.
Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) allows a network-positioned attacker to intercept or modify encrypted management traffic between those devices and their cloud controllers. The flaw - classified as CWE-295 - means the devices do not adequately confirm that a presented TLS certificate belongs to the expected cloud controller hostname, enabling a machine-in-the-middle to substitute a fraudulent certificate and break the trust boundary. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor has released patched firmware.