CVE-2025-15628
Hardcoded Certificates in TP-Link Omada Device Communications
- State
- Published
- Severity
- 8.2 High
- Published
- Aug 3, 2026
- Updated
- Aug 3, 2026
- Reserved
- Apr 10, 2026
Description
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices.
An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | TPLink |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
Omada GatewaysTP-Link Systems Inc. |
|
Omada SwitchesTP-Link Systems Inc. |
|
Omada Access PointsTP Link Systems Inc. |
|
Omada ControllersTP-Link Systems Inc |
|
Omada OLTsTP-Link Systems Inc. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.