{"id":"CVE-2025-9290","title":"An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values","summary":"An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker t…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-760"],"vendor":"tp-link","product":"omada_controller","affected":["omada_controller < 6.0.0.24","omada_controller < 6.0.0.100","oc200_firmware < 1.37.9","oc220_firmware < 1.1.3","oc300_firmware < 1.31.9","oc400_firmware < 1.9.9","oc200_firmware < 2.22.9","oc220_firmware","er605_firmware < 2.3.2","er7206_firmware < 2.2.2","er7406_firmware < 1.2.2","er707-m2_firmware < 1.3.1","er7412-m2_firmware < 1.1.0","er8411_firmware < 1.3.5","er706w_firmware < 1.2.1","er706w-4g_firmware < 1.2.1","er706wp-4g_firmware < 1.1.0","er703wp-4g-outdoor_firmware < 1.1.0","dr3220v-4g_firmware < 1.1.0","dr3650v-4g_firmware < 1.1.0","dr3650v_firmware < 1.1.0","er701-5g-outdoor_firmware < 1.0.0","er605w_firmware < 2.0.2","er7212pc_firmware < 2.2.1","fr365_firmware < 1.1.10","g36w-4g_firmware < 1.1.5","eap655-wall_firmware < 1.6.2","eap660_hd_firmware < 1.6.1","eap620_hd_firmware < 1.6.1","eap610-outdoor_firmware < 1.6.1","eap610_firmware < 1.6.1","eap623-outdoor_hd_firmware < 1.6.1","eap625-outdoor_hd_firmware < 1.6.1","eap772_firmware < 1.3.2","eap772-outdoor_firmware < 1.3.2","eap770_firmware < 1.3.2","eap723_firmware < 1.3.2","eap773_firmware < 1.1.2","eap783_firmware < 1.1.2","eap772_firmware < 1.1.2","eap787_firmware < 1.1.2","eap720_firmware < 1.1.2","eap723_firmware < 1.1.2","eap725-wall_firmware < 1.1.2","eap215_bridge_kit_firmware < 1.1.4","eap211_bridge_kit_firmware < 1.1.4","beam_bridge_5_ur_firmware < 1.1.5","eap603gp-desktop_firmware < 1.1.0","eap615gp-wall_firmware < 1.1.0","eap625gp-wall_firmware < 1.1.0","eap610gp-desktop_firmware < 1.1.0","eap650gp-desktop_firmware < 1.0.1","eap653_firmware < 1.3.3","eap650-outdoor_firmware < 1.3.3","eap230-wall_firmware < 3.3.1","eap235-wall_firmware < 3.3.1","eap603-outdoor_firmware < 1.5.1","eap653_ur_firmware < 1.4.2","eap650-desktop_firmware < 1.1.0","eap615-wall_firmware < 1.1.0","eap100-bridge_kit_firmware < 1.0.3","er706w-4g_firmware < 2.1.0","omada_controller < 6.0.0.34","omada_controller < 5.15.24"],"patched":["omada_controller 5.15.24","oc200_firmware 2.22.9","oc220_firmware 1.1.3","oc300_firmware 1.31.9","oc400_firmware 1.9.9","er605_firmware 2.3.2","er7206_firmware 2.2.2","er7406_firmware 1.2.2","er707-m2_firmware 1.3.1","er7412-m2_firmware 1.1.0","er8411_firmware 1.3.5","er706w_firmware 1.2.1","er706w-4g_firmware 2.1.0","er706wp-4g_firmware 1.1.0","er703wp-4g-outdoor_firmware 1.1.0","dr3220v-4g_firmware 1.1.0","dr3650v-4g_firmware 1.1.0","dr3650v_firmware 1.1.0","er701-5g-outdoor_firmware 1.0.0","er605w_firmware 2.0.2","er7212pc_firmware 2.2.1","fr365_firmware 1.1.10","g36w-4g_firmware 1.1.5","eap655-wall_firmware 1.6.2","eap660_hd_firmware 1.6.1","eap620_hd_firmware 1.6.1","eap610-outdoor_firmware 1.6.1","eap610_firmware 1.6.1","eap623-outdoor_hd_firmware 1.6.1","eap625-outdoor_hd_firmware 1.6.1","eap772_firmware 1.1.2","eap772-outdoor_firmware 1.3.2","eap770_firmware 1.3.2","eap723_firmware 1.1.2","eap773_firmware 1.1.2","eap783_firmware 1.1.2","eap787_firmware 1.1.2","eap720_firmware 1.1.2","eap725-wall_firmware 1.1.2","eap215_bridge_kit_firmware 1.1.4","eap211_bridge_kit_firmware 1.1.4","beam_bridge_5_ur_firmware 1.1.5","eap603gp-desktop_firmware 1.1.0","eap615gp-wall_firmware 1.1.0","eap625gp-wall_firmware 1.1.0","eap610gp-desktop_firmware 1.1.0","eap650gp-desktop_firmware 1.0.1","eap653_firmware 1.3.3","eap650-outdoor_firmware 1.3.3","eap230-wall_firmware 3.3.1","eap235-wall_firmware 3.3.1","eap603-outdoor_firmware 1.5.1","eap653_ur_firmware 1.4.2","eap650-desktop_firmware 1.1.0","eap615-wall_firmware 1.1.0","eap100-bridge_kit_firmware 1.0.3"],"published":"2026-01-23","updated":"2026-10-07","sourceUpdated":"2026-10-07T00:17:19.853","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9290","references":[{"url":"https://support.omadanetworks.com/en/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/document/114950/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/download/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-23T20:04:16.930287Z"},"scores":{"nvd":5.9,"cna":6},"epss":0.00222,"epssPercentile":0.12707,"ingestedAt":"2026-10-07T00:26:32.088Z","slug":"CVE-2025-9290","body":"## Overview\n\nAn authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.\n\n## Affected\n\n- `omada_controller < 6.0.0.24`\n- `omada_controller < 6.0.0.100`\n- `oc200_firmware < 1.37.9`\n- `oc220_firmware < 1.1.3`\n- `oc300_firmware < 1.31.9`\n- `oc400_firmware < 1.9.9`\n- `oc200_firmware < 2.22.9`\n- `oc220_firmware`\n- `er605_firmware < 2.3.2`\n- `er7206_firmware < 2.2.2`\n- `er7406_firmware < 1.2.2`\n- `er707-m2_firmware < 1.3.1`\n- `er7412-m2_firmware < 1.1.0`\n- `er8411_firmware < 1.3.5`\n- `er706w_firmware < 1.2.1`\n- `er706w-4g_firmware < 1.2.1`\n- `er706wp-4g_firmware < 1.1.0`\n- `er703wp-4g-outdoor_firmware < 1.1.0`\n- `dr3220v-4g_firmware < 1.1.0`\n- `dr3650v-4g_firmware < 1.1.0`\n- `dr3650v_firmware < 1.1.0`\n- `er701-5g-outdoor_firmware < 1.0.0`\n- `er605w_firmware < 2.0.2`\n- `er7212pc_firmware < 2.2.1`\n- `fr365_firmware < 1.1.10`\n- `g36w-4g_firmware < 1.1.5`\n- `eap655-wall_firmware < 1.6.2`\n- `eap660_hd_firmware < 1.6.1`\n- `eap620_hd_firmware < 1.6.1`\n- `eap610-outdoor_firmware < 1.6.1`\n- `eap610_firmware < 1.6.1`\n- `eap623-outdoor_hd_firmware < 1.6.1`\n- `eap625-outdoor_hd_firmware < 1.6.1`\n- `eap772_firmware < 1.3.2`\n- `eap772-outdoor_firmware < 1.3.2`\n- `eap770_firmware < 1.3.2`\n- `eap723_firmware < 1.3.2`\n- `eap773_firmware < 1.1.2`\n- `eap783_firmware < 1.1.2`\n- `eap772_firmware < 1.1.2`\n- `eap787_firmware < 1.1.2`\n- `eap720_firmware < 1.1.2`\n- `eap723_firmware < 1.1.2`\n- `eap725-wall_firmware < 1.1.2`\n- `eap215_bridge_kit_firmware < 1.1.4`\n- `eap211_bridge_kit_firmware < 1.1.4`\n- `beam_bridge_5_ur_firmware < 1.1.5`\n- `eap603gp-desktop_firmware < 1.1.0`\n- `eap615gp-wall_firmware < 1.1.0`\n- `eap625gp-wall_firmware < 1.1.0`\n- `eap610gp-desktop_firmware < 1.1.0`\n- `eap650gp-desktop_firmware < 1.0.1`\n- `eap653_firmware < 1.3.3`\n- `eap650-outdoor_firmware < 1.3.3`\n- `eap230-wall_firmware < 3.3.1`\n- `eap235-wall_firmware < 3.3.1`\n- `eap603-outdoor_firmware < 1.5.1`\n- `eap653_ur_firmware < 1.4.2`\n- `eap650-desktop_firmware < 1.1.0`\n- `eap615-wall_firmware < 1.1.0`\n- `eap100-bridge_kit_firmware < 1.0.3`\n- `er706w-4g_firmware < 2.1.0`\n- `omada_controller < 6.0.0.34`\n- `omada_controller < 5.15.24`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `omada_controller 5.15.24`\n- `oc200_firmware 2.22.9`\n- `oc220_firmware 1.1.3`\n- `oc300_firmware 1.31.9`\n- `oc400_firmware 1.9.9`\n- `er605_firmware 2.3.2`\n- `er7206_firmware 2.2.2`\n- `er7406_firmware 1.2.2`\n- `er707-m2_firmware 1.3.1`\n- `er7412-m2_firmware 1.1.0`\n- `er8411_firmware 1.3.5`\n- `er706w_firmware 1.2.1`\n- `er706w-4g_firmware 2.1.0`\n- `er706wp-4g_firmware 1.1.0`\n- `er703wp-4g-outdoor_firmware 1.1.0`\n- `dr3220v-4g_firmware 1.1.0`\n- `dr3650v-4g_firmware 1.1.0`\n- `dr3650v_firmware 1.1.0`\n- `er701-5g-outdoor_firmware 1.0.0`\n- `er605w_firmware 2.0.2`\n- `er7212pc_firmware 2.2.1`\n- `fr365_firmware 1.1.10`\n- `g36w-4g_firmware 1.1.5`\n- `eap655-wall_firmware 1.6.2`\n- `eap660_hd_firmware 1.6.1`\n- `eap620_hd_firmware 1.6.1`\n- `eap610-outdoor_firmware 1.6.1`\n- `eap610_firmware 1.6.1`\n- `eap623-outdoor_hd_firmware 1.6.1`\n- `eap625-outdoor_hd_firmware 1.6.1`\n- `eap772_firmware 1.1.2`\n- `eap772-outdoor_firmware 1.3.2`\n- `eap770_firmware 1.3.2`\n- `eap723_firmware 1.1.2`\n- `eap773_firmware 1.1.2`\n- `eap783_firmware 1.1.2`\n- `eap787_firmware 1.1.2`\n- `eap720_firmware 1.1.2`\n- `eap725-wall_firmware 1.1.2`\n- `eap215_bridge_kit_firmware 1.1.4`\n- `eap211_bridge_kit_firmware 1.1.4`\n- `beam_bridge_5_ur_firmware 1.1.5`\n- `eap603gp-desktop_firmware 1.1.0`\n- `eap615gp-wall_firmware 1.1.0`\n- `eap625gp-wall_firmware 1.1.0`\n- `eap610gp-desktop_firmware 1.1.0`\n- `eap650gp-desktop_firmware 1.0.1`\n- `eap653_firmware 1.3.3`\n- `eap650-outdoor_firmware 1.3.3`\n- `eap230-wall_firmware 3.3.1`\n- `eap235-wall_firmware 3.3.1`\n- `eap603-outdoor_firmware 1.5.1`\n- `eap653_ur_firmware 1.4.2`\n- `eap650-desktop_firmware 1.1.0`\n- `eap615-wall_firmware 1.1.0`\n- `eap100-bridge_kit_firmware 1.0.3`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}