CVE-2025-9290: tp-link systems inc. omada access point (eap215 bridge kit 3.0, eap211 bridge kit 3.0)

Vulnerability summary

CVE-2025-9290 is a medium (CVSS 6.0) vulnerability in tp-link systems inc. omada access point (eap215 bridge kit 3.0, eap211 bridge kit 3.0). EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12% of scored vulnerabilities.

Timeline

1. 22-01-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

• CWE-760Use of a One-Way Hash with a Predictable SaltThe product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.