CVE-2025-15631: tp link systems inc. omada access points Use of a One-Way Hash without a Salt
Vulnerability summary
CVE-2025-15631 is a medium (CVSS 5.9) Use of a One-Way Hash without a Salt vulnerability in tp link systems inc. omada access points. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.
Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.7MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
+0.12 pp
From 0.18% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tp-link109 products
- omada_ds1008x_firmwarena
- omada_ds1016g_firmwarena
- omada_ds1016ge_firmwarena
- omada_ds1018gmp_firmwarena
- omada_ds1024g_firmwarena
Tp-link systems inc.3 products
- omada gatewaysAll versions (No fix recorded)
- omada oltsAll versions (No fix recorded)
- omada switchesAll versions (No fix recorded)
Tp link systems inc.1 product
- omada access pointsAll versions (No fix recorded)
3 vendors · 113 products
References
3 links- www.tp-link.com/us/support/faq/5216/Vendor Advisory