CVE-2025-9291CWE-295

CVE-2025-9291

Medium · published August 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

A

certification validation weakness exists in communication between affected

Omada devices and cloud controllers. Certificate identity verification does not

adequately validate that a presented certificate corresponds to the expected

cloud controller hostname, which may allow certificate validation protections

to be bypassed under specific conditions.

Successful

exploitation may allow interception or modification of communication between

affected devices and cloud controllers.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-08-03T22:16Z
Affected products (109)
ProductVersionsFixed in
tp-link/omada_fusion_2.5g_firmwareall versions—
tp-link/omada_er707-m2_firmwareall versions—
tp-link/omada_er7206_firmwareall versions—
tp-link/omada_er706w_firmwareall versions—
tp-link/omada_er8411_firmwareall versions—
tp-link/omada_er605_firmwareall versions—
tp-link/omada_er7412-m2_firmwareall versions—
tp-link/omada_er706w-4g_firmwareall versions—
tp-link/omada_er703wp-4g-outdoor_firmwareall versions—
tp-link/omada_er706wp-4g_firmwareall versions—
tp-link/omada_s7500-24y4c_firmwareall versions—
tp-link/omada_s7500-26xf6y_firmwareall versions—
tp-link/omada_s6500-48mpp6y_firmwareall versions—
tp-link/omada_s6500-24mpp4y_firmwareall versions—
tp-link/omada_s6500-48gp6xf_firmwareall versions—
tp-link/omada_s6500-48g6xf_firmwareall versions—
tp-link/omada_s6500-24gp4xf_firmwareall versions—
tp-link/omada_s6500-24g4xf_firmwareall versions—
tp-link/omada_sx6632yf_firmwareall versions—
tp-link/omada_sx3032f_firmwareall versions—
tp-link/omada_sx3016f_firmwareall versions—
tp-link/omada_sx3008f_firmwareall versions—
tp-link/omada_sg3428xf_firmwareall versions—
tp-link/omada_sx3832mpp_firmwareall versions—
tp-link/omada_sx3832_firmwareall versions—
tp-link/omada_sx3206hpp_firmwareall versions—
tp-link/omada_sg3428xpp-m2_firmwareall versions—
tp-link/omada_sg3428x-m2_firmwareall versions—
tp-link/omada_sg3218xp-m2_firmwareall versions—
tp-link/omada_sg3210xhp-m2_firmwareall versions—
tp-link/omada_sg3210x-m2_firmwareall versions—
tp-link/omada_sg2210xmp-m2_firmwareall versions—
tp-link/omada_sg6654xhp_firmwareall versions—
tp-link/omada_sg6654x_firmwareall versions—
tp-link/omada_sg6428xhp_firmwareall versions—
tp-link/omada_sg6428x_firmwareall versions—
tp-link/omada_sg5452xmpp_firmwareall versions—
tp-link/omada_sg5452x_firmwareall versions—
tp-link/omada_sg5428xmpp_firmwareall versions—
tp-link/omada_sg5428x_firmwareall versions—
tp-link/omada_sg3452xmpp_firmwareall versions—
tp-link/omada_sg3452xp_firmwareall versions—
tp-link/omada_tl-sg3452x_firmwareall versions—
tp-link/omada_sg3428xmpp_firmwareall versions—
tp-link/omada_sg3428xmp_firmwareall versions—
tp-link/omada_sg3428x_firmwareall versions—
tp-link/omada_sg2005p-pd_firmwareall versions—
tp-link/omada_sg3452p_firmwareall versions—
tp-link/omada_sg3452_firmwareall versions—
tp-link/omada_sg3428mp_firmwareall versions—
tp-link/omada_sg3428_firmwareall versions—
tp-link/omada_sg3210_firmwareall versions—
tp-link/omada_tl-sg3210_firmwareall versions—
tp-link/omada_sg2452lp_firmwareall versions—
tp-link/omada_sg2428p_firmwareall versions—
tp-link/omada_sg2428lp_firmwareall versions—
tp-link/omada_sg2218p_firmwareall versions—
tp-link/omada_sg2218_firmwareall versions—
tp-link/omada_sg2016p_firmwareall versions—
tp-link/omada_sg2210mp_firmwareall versions—
tp-link/omada_sg2210p_firmwareall versions—
tp-link/omada_sg2008p_firmwareall versions—
tp-link/omada_sg2008_firmwareall versions—
tp-link/omada_sg2206mp_firmwareall versions—
tp-link/omada_es210xpp-m2_firmwareall versions—
tp-link/omada_es210x-m2_firmwareall versions—
tp-link/omada_es206xpp-m2_firmwareall versions—
tp-link/omada_es206x-m2_firmwareall versions—
tp-link/omada_es228gmp_firmwareall versions—
tp-link/omada_es228gp_firmwareall versions—
tp-link/omada_es224g_firmwareall versions—
tp-link/omada_es220gp_firmwareall versions—
tp-link/omada_es216g_firmwareall versions—
tp-link/omada_es210gmp_firmwareall versions—
tp-link/omada_es210gp_firmwareall versions—
tp-link/omada_es208gp_firmwareall versions—
tp-link/omada_es208g_firmwareall versions—
tp-link/omada_es206gp_firmwareall versions—
tp-link/omada_es205gp_firmwareall versions—
tp-link/omada_es205g_firmwareall versions—
tp-link/omada_es220gmp_firmwareall versions—
tp-link/omada_es1024ge_firmwareall versions—
tp-link/omada_ds1016ge_firmwareall versions—
tp-link/omada_ds108ge_firmwareall versions—
tp-link/omada_ds105ge_firmwareall versions—
tp-link/omada_ds1008x_firmwareall versions—
tp-link/omada_ds105x_firmwareall versions—
tp-link/omada_ds108g-m2_firmwareall versions—
tp-link/omada_ds105g-m2_firmwareall versions—
tp-link/omada_ds1024g_firmwareall versions—
tp-link/omada_ds1016g_firmwareall versions—
tp-link/omada_ds110gmp_firmwareall versions—
tp-link/omada_ds108g_firmwareall versions—
tp-link/omada_ds106gpp_firmwareall versions—
tp-link/omada_ds106p_firmwareall versions—
tp-link/omada_ds105g_firmwareall versions—
tp-link/omada_ds111p_firmwareall versions—
tp-link/omada_ds1018gmp_firmwareall versions—
tp-link/omada_ds108gp_firmwareall versions—
tp-link/omada_ds105gp_firmwareall versions—
tp-link/omada_ies210gpp_firmwareall versions—
tp-link/omada_ies206gpp_firmwareall versions—
tp-link/omada_ies208g_firmwareall versions—
tp-link/omada_ies206g_firmwareall versions—
tp-link/omada_eap660hd_firmwareall versions—
tp-link/omada_eap620hd_firmwareall versions—
tp-link/omada_eap610_firmwareall versions—
tp-link/omada_eap615-wall_firmwareall versions—
tp-link/omada_eap610-outdoor_firmwareall versions—
References (3)
EPSS history
Timeline
  • 03 AUG 17:48Z
    Improper Certificate Validation in TP-Link Omada Cloud Communications
    cvelistv5