NetSight
IP …
medium5.9

CVE-2025-9290

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value…

Impact

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Affected products

VendorProductAffected versions
Tp-LinkOmada Controller
before 6.0.0.24
before 6.0.0.100
before 6.0.0.34
before 5.15.24
Tp-LinkOc200 Firmware
before 1.37.9
before 2.22.9
Tp-LinkOc220 Firmware
before 1.1.3
All versions
Tp-LinkOc300 Firmware
before 1.31.9
Tp-LinkOc400 Firmware
before 1.9.9
Tp-LinkEr605 Firmware
before 2.3.2
Tp-LinkEr7206 Firmware
before 2.2.2
Tp-LinkEr7406 Firmware
before 1.2.2
Tp-LinkEr707-M2 Firmware
before 1.3.1
Tp-LinkEr7412-M2 Firmware
before 1.1.0
Tp-LinkEr8411 Firmware
before 1.3.5
Tp-LinkEr706w Firmware
before 1.2.1

Weakness classification

CWE-760

References