Tp Link Omada vulnerabilities

3 vulnerabilities

Known vulnerabilities in Tp Link Omada, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2025-9292tp-link systems inc.omada cloud controller+14
EPSS score
0.39%
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.8.1CVE-2025-9293tp link systems inc.omada app+27
EPSS score
0.24%
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.6.9CVE-2025-15544tp link systems inc.omada access points+118
EPSS score
0.34%
A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.