CVE-2025-15631
Weak Credential Storage in TP-Link Omada Devices
- State
- Published
- Severity
- 5.7 Medium
- Published
- Aug 3, 2026
- Updated
- Aug 3, 2026
- Reserved
- Apr 10, 2026
Description
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection.
An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.7 Medium | CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | TPLink |
Weaknesses
- CWE-759 Use of a One-Way hash without a salt
Affected Products
| Product | Versions |
|---|---|
Omada GatewaysTP-Link Systems Inc. |
|
Omada SwitchesTP-Link Systems Inc. |
|
Omada Access PointsTP Link Systems Inc. |
|
Omada OLTsTP-Link Systems Inc. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.