CVE-2025-9291
Improper Certificate Validation in TP-Link Omada Cloud Communications
- State
- Published
- Severity
- 7.7 High
- Published
- Aug 3, 2026
- Updated
- Aug 5, 2026
- Reserved
- Aug 20, 2025
Description
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions.
Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | TPLink |
Weaknesses
- CWE-295 Improper certificate validation
Affected Products
| Product | Versions |
|---|---|
Omada GatewaysTP-Link Systems Inc. |
|
Omada SwitchesTP-Link Systems Inc. |
|
Omada Access PointsTP-Link Systems Inc. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.