TP-Link Systems Inc. Omada Gateways
11 CVEs affecting TP-Link Systems Inc. Omada Gateways. Latest disclosed: 2026-08-03. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-6542 | Critical | 9.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. |
CVE-2025-6541 | High | 8.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed dev… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentica… |
CVE-2025-7850 | High | 7.2 | 2025-10-21 | A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmit… |