Log in Start free

Vulnerability · Published Aug 3, 2026 · Assigned by TPLink

CVE-2025-15544Weak Credential Protection During TP-Link Omada Device Adoption

Medium 6.9

In plain English

A medium-severity security flaw in Omada Access Points from TP Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 72.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

Affected products (as reported)

VendorProductVersions
TP-Link Systems Inc. Omada Gateways 0
TP-Link Systems Inc. Omada Switches 0
TP Link Systems Inc. Omada Access Points 0
TP-Link Systems Inc. Omada App 0
TP-Link Systems Inc Omada Controllers 0
TP-Link Systems Inc Omada OLTs 0

Weakness: CWE-759 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References