CVE-2025-9290: Authentication Weakness on Omada Controllers, Gateways and Access Points

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-23 · updated 2026-10-07
Weakness: CWE-760

Description

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Affected products

TP-Link Beam Bridge 5 Ur Firmware: before 1.1.5 — fixed in 1.1.5
TP-Link Dr3220V-4G Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Dr3650V-4G Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Dr3650V Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap100-Bridge Kit Firmware: before 1.0.3 — fixed in 1.0.3
TP-Link Eap211 Bridge Kit Firmware: before 1.1.4 — fixed in 1.1.4
TP-Link Eap215 Bridge Kit Firmware: before 1.1.4 — fixed in 1.1.4
TP-Link Eap230-Wall Firmware: before 3.3.1 — fixed in 3.3.1
TP-Link Eap235-Wall Firmware: before 3.3.1 — fixed in 3.3.1
TP-Link Eap603-Outdoor Firmware: before 1.5.1 — fixed in 1.5.1
TP-Link Eap603Gp-Desktop Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap610-Outdoor Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap610 Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap610Gp-Desktop Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap615-Wall Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap615Gp-Wall Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap620 Hd Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap623-Outdoor Hd Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap625-Outdoor Hd Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap625Gp-Wall Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap650-Desktop Firmware: before 1.1.0 — fixed in 1.1.0
TP-Link Eap650-Outdoor Firmware: before 1.3.3 — fixed in 1.3.3
TP-Link Eap650Gp-Desktop Firmware: before 1.0.1 — fixed in 1.0.1
TP-Link Eap653 Firmware: before 1.3.3 — fixed in 1.3.3
TP-Link Eap653 Ur Firmware: before 1.4.2 — fixed in 1.4.2
TP-Link Eap655-Wall Firmware: before 1.6.2 — fixed in 1.6.2
TP-Link Eap660 Hd Firmware: before 1.6.1 — fixed in 1.6.1
TP-Link Eap720 Firmware: before 1.1.2 — fixed in 1.1.2
TP-Link Eap723 Firmware: before 1.3.2; before 1.1.2 — fixed in 1.1.2, 1.3.2
TP-Link Eap725-Wall Firmware: before 1.1.2 — fixed in 1.1.2

How to fix

Upgrade to a fixed version: TP-Link Beam Bridge 5 Ur Firmware 1.1.5; TP-Link Dr3220V-4G Firmware 1.1.0; TP-Link Dr3650V-4G Firmware 1.1.0; TP-Link Dr3650V Firmware 1.1.0; TP-Link Eap100-Bridge Kit Firmware 1.0.3; TP-Link Eap211 Bridge Kit Firmware 1.1.4; TP-Link Eap215 Bridge Kit Firmware 1.1.4; TP-Link Eap230-Wall Firmware 3.3.1; TP-Link Eap235-Wall Firmware 3.3.1; TP-Link Eap603-Outdoor Firmware 1.5.1; TP-Link Eap603Gp-Desktop Firmware 1.1.0; TP-Link Eap610-Outdoor Firmware 1.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9290 or the next vulnerability affects your stack