CVE-2025-15544: tp link systems inc. omada access points Use of a One-Way Hash without a Salt

Vulnerability summary

CVE-2025-15544 is a medium (CVSS 6.9) Use of a One-Way Hash without a Salt vulnerability in tp link systems inc. omada access points. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.4% of scored vulnerabilities.

Timeline

1. 03-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

• CWE-759Use of a One-Way Hash without a SaltThe product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.