CVE-2025-9290

Published: Jan 23, 2026Modified: Jun 17, 2026

6.0

Vector

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f23511db-6c3e-4e32-a477-6aa17d310630 (Secondary)

Description

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Affected (64)

Products: Tp Link: Omada Controller, Oc200 Firmware, Oc220 Firmware, Oc300 Firmware, Oc400 Firmware, Er605 Firmware, Er7206 Firmware, Er7406 Firmware, Er707 M2 Firmware, Er7412 M2 Firmware, Er8411 Firmware, Er706w Firmware, Er706w 4g Firmware, Er706wp 4g Firmware, Er703wp 4g Outdoor Firmware, Dr3220v 4g Firmware, Dr3650v 4g Firmware, Dr3650v Firmware, Er701 5g Outdoor Firmware, Er605w Firmware, Er7212pc Firmware, Fr365 Firmware, G36w 4g Firmware, Eap655 Wall Firmware, Eap660 Hd Firmware, Eap620 Hd Firmware, Eap610 Outdoor Firmware, Eap610 Firmware, Eap623 Outdoor Hd Firmware, Eap625 Outdoor Hd Firmware, Eap772 Firmware, Eap772 Outdoor Firmware, Eap770 Firmware, Eap723 Firmware, Eap773 Firmware, Eap783 Firmware, Eap787 Firmware, Eap720 Firmware, Eap725 Wall Firmware, Eap215 Bridge Kit Firmware, Eap211 Bridge Kit Firmware, Beam Bridge 5 Ur Firmware, Eap603gp Desktop Firmware, Eap615gp Wall Firmware, Eap625gp Wall Firmware, Eap610gp Desktop Firmware, Eap650gp Desktop Firmware, Eap653 Firmware, Eap650 Outdoor Firmware, Eap230 Wall Firmware, Eap235 Wall Firmware, Eap603 Outdoor Firmware, Eap653 Ur Firmware, Eap650 Desktop Firmware, Eap615 Wall Firmware, Eap100 Bridge Kit Firmware

56 products

Er703wp 4g Outdoor Firmware

Dr3220v 4g Firmware

Dr3650v 4g Firmware

Dr3650v Firmware

Er701 5g Outdoor Firmware

Eap610 Outdoor Firmware

Eap610 Firmware

Eap623 Outdoor Hd Firmware

Eap625 Outdoor Hd Firmware

Eap772 Firmware

Eap772 Outdoor Firmware

Eap215 Bridge Kit Firmware

Eap211 Bridge Kit Firmware

Beam Bridge 5 Ur Firmware

Eap603gp Desktop Firmware

Eap615gp Wall Firmware

Eap625gp Wall Firmware

Eap610gp Desktop Firmware

Eap650gp Desktop Firmware

Eap653 Firmware

Eap650 Outdoor Firmware

Eap230 Wall Firmware

Eap235 Wall Firmware

Eap603 Outdoor Firmware

Eap653 Ur Firmware

Eap650 Desktop Firmware

Eap615 Wall Firmware

Eap100 Bridge Kit Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Tp Link Omada Controller	Before 6.0.0.24
Tp Link Omada Controller	Before 6.0.0.100

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc200 Firmware	Before 1.37.9

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc220 Firmware	Before 1.1.3

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc300 Firmware	Before 1.31.9

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc400 Firmware	Before 1.9.9

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc200 Firmware	Before 2.22.9

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Tp Link Oc220 Firmware	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er605 Firmware	Before 2.3.2

Running on/with	Platform Versions
Tp Link Er605	Version 2.0

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er7206 Firmware	Before 2.2.2

Running on/with	Platform Versions
Tp Link Er7206	Version 2.0

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er7406 Firmware	Before 1.2.2

Running on/with	Platform Versions
Tp Link Er7406	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er707 M2 Firmware	Before 1.3.1

Running on/with	Platform Versions
Tp Link Er707 M2	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er7412 M2 Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Er7412 M2	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er8411 Firmware	Before 1.3.5

Running on/with	Platform Versions
Tp Link Er8411	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er706w Firmware	Before 1.2.1

Running on/with	Platform Versions
Tp Link Er706w	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er706w 4g Firmware	Before 1.2.1

Running on/with	Platform Versions
Tp Link Er706w 4g	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er706wp 4g Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Er706wp 4g	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er703wp 4g Outdoor Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Er703wp 4g Outdoor	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Dr3220v 4g Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Dr3220v 4g	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Dr3650v 4g Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Dr3650v 4g	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Dr3650v Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Dr3650v	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er701 5g Outdoor Firmware	Before 1.0.0

Running on/with	Platform Versions
Tp Link Er701 5g Outdoor	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er605w Firmware	Before 2.0.2

Running on/with	Platform Versions
Tp Link Er605w	Version 2.0

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er7212pc Firmware	Before 2.2.1

Running on/with	Platform Versions
Tp Link Er7212pc	Version 2.0

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Fr365 Firmware	Before 1.1.10

Running on/with	Platform Versions
Tp Link Fr365	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link G36w 4g Firmware	Before 1.1.5

Running on/with	Platform Versions
Tp Link G36w 4g	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap655 Wall Firmware	Before 1.6.2

Running on/with	Platform Versions
Tp Link Eap655 Wall	Version 1.0

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap660 Hd Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap660 Hd	Version 1.0
Tp Link Eap660 Hd	Version 2.0

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap620 Hd Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap620 Hd	Version 3.0
Tp Link Eap620 Hd	Version 3.20

Configuration C

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap610 Outdoor Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap610 Outdoor	Version 1.0
Tp Link Eap610 Outdoor	Version 1.20

Configuration D

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap610 Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap610	Version 1.0
Tp Link Eap610	Version 2.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap623 Outdoor Hd Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap623 Outdoor Hd	Version 1.0

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap625 Outdoor Hd Firmware	Before 1.6.1

Running on/with	Platform Versions
Tp Link Eap625 Outdoor Hd	Version 1.0

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap772 Firmware	Before 1.3.2

Running on/with	Platform Versions
Tp Link Eap772	Version 2.0

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap772 Outdoor Firmware	Before 1.3.2

Running on/with	Platform Versions
Tp Link Eap772 Outdoor	Version 1.0

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap770 Firmware	Before 1.3.2

Running on/with	Platform Versions
Tp Link Eap770	Version 2.0

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap723 Firmware	Before 1.3.2

Running on/with	Platform Versions
Tp Link Eap723	Version 1.0

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap773 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap773	Version 1.0

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap783 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap783	Version 1.0

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap772 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap772	Version 1.0

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap787 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap787	Version 1.0

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap720 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap720	Version 1.0

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap723 Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap723	Version 2.0

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap725 Wall Firmware	Before 1.1.2

Running on/with	Platform Versions
Tp Link Eap725 Wall	Version 1.0

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap215 Bridge Kit Firmware	Before 1.1.4

Running on/with	Platform Versions
Tp Link Eap215 Bridge Kit	Version 3.0

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap211 Bridge Kit Firmware	Before 1.1.4

Running on/with	Platform Versions
Tp Link Eap211 Bridge Kit	Version 3.0

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Beam Bridge 5 Ur Firmware	Before 1.1.5

Running on/with	Platform Versions
Tp Link Beam Bridge 5 Ur	Version 1.0

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap603gp Desktop Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap603gp Desktop	Version 1.0

Configuration V

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap615gp Wall Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap615gp Wall	Version 1.0
Tp Link Eap615gp Wall	Version 1.20

Configuration W

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Eap625gp Wall Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap625gp Wall	Version 1.0
Tp Link Eap625gp Wall	Version 1.20

Configuration X

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Tp Link Eap610gp Desktop Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap610gp Desktop	Version 1.0
Tp Link Eap610gp Desktop	Version 1.20
Tp Link Eap610gp Desktop	Version 1.26

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap650gp Desktop Firmware	Before 1.0.1

Running on/with	Platform Versions
Tp Link Eap650gp Desktop	Version 1.0

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap653 Firmware	Before 1.3.3

Running on/with	Platform Versions
Tp Link Eap653	Version 1.0

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap650 Outdoor Firmware	Before 1.3.3

Running on/with	Platform Versions
Tp Link Eap650 Outdoor	Version 1.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap230 Wall Firmware	Before 3.3.1

Running on/with	Platform Versions
Tp Link Eap230 Wall	Version 1.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap235 Wall Firmware	Before 3.3.1

Running on/with	Platform Versions
Tp Link Eap235 Wall	Version 1.0

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap603 Outdoor Firmware	Before 1.5.1

Running on/with	Platform Versions
Tp Link Eap603 Outdoor	Version 1.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap653 Ur Firmware	Before 1.4.2

Running on/with	Platform Versions
Tp Link Eap653 Ur	Version 1.0

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap650 Desktop Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap650 Desktop	Version 1.0

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap615 Wall Firmware	Before 1.1.0

Running on/with	Platform Versions
Tp Link Eap615 Wall	Version 1.0

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Eap100 Bridge Kit Firmware	Before 1.0.3

Running on/with	Platform Versions
Tp Link Eap100 Bridge Kit	Version 1.0

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Er706w 4g Firmware	Before 2.1.0

Running on/with	Platform Versions
Tp Link Er706w 4g	Version 2.0

Configuration J

1 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Tp Link Omada Controller	Before 6.0.0.34

Running on/with	Platform Versions
Tp Link Oc200	Version 1
Tp Link Oc200	Version 2
Tp Link Oc300	Version 1.6
Tp Link Oc400	Version 1.6

Configuration K

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Tp Link Omada Controller	Before 5.15.24

Running on/with	Platform Versions
Tp Link Oc220	Version 1
Tp Link Oc220	Version 2

Related CWEs

CWE-760

Use of a One-Way Hash with a Predictable Salt

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

References (3)

https://support.omadanetworks.com/en/download/

Source: f23511db-6c3e-4e32-a477-6aa17d310630

Product

https://support.omadanetworks.com/us/document/114950/

Source: f23511db-6c3e-4e32-a477-6aa17d310630

Vendor Advisory

https://support.omadanetworks.com/us/download/

Source: f23511db-6c3e-4e32-a477-6aa17d310630

Product

Timeline

No history available yet.