Vulnerability · Published Aug 3, 2026 · Assigned by TPLink
CVE-2025-9291Improper Certificate Validation in TP-Link Omada Cloud Communications
High 7.7
In plain English
A high-severity improper certificate validation in Omada Access Points from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Omada Gateways | 0 |
| TP-Link Systems Inc. | Omada Switches | 0 |
| TP-Link Systems Inc. | Omada Access Points | 0 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N