high7.5
CVE-2025-15628
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices.
Impact
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Omada Oc200 V3 Firmware | All versions |
| Tp-Link | Omada Oc300 Firmware | All versions |
| Tp-Link | Omada Oc400 Firmware | All versions |
| Tp-Link | Omada Fusion 2.5g Firmware | All versions |
| Tp-Link | Omada Er707-M2 Firmware | All versions |
| Tp-Link | Omada Tl-Sg3452x Firmware | All versions |
| Tp-Link | Omada Sg3428xmpp Firmware | All versions |
| Tp-Link | Omada Sg3428xmp Firmware | All versions |
| Tp-Link | Omada Sg3428x Firmware | All versions |
| Tp-Link | Omada Sg2005p-Pd Firmware | All versions |
| Tp-Link | Omada Sg3452p Firmware | All versions |
| Tp-Link | Omada Sg3452 Firmware | All versions |