Certificate Validation Weakness in TP-Link Omada Cloud Controllers
CVE-2025-9291

7.7HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Omada Gateways
Omada Switches
Omada Access Points
Vendor
CVE Published:
3 August 2026

What is CVE-2025-9291?

A certificate validation weakness exists in the communication between TP-Link Omada devices and their associated cloud controllers. This vulnerability arises from inadequate verification processes for presented certificates, which fail to confirm that the certificate matches the expected hostname of the cloud controller. As a result, under certain conditions, attackers may exploit this oversight to intercept or modify data exchanges between the devices and the cloud controllers, posing a significant risk to network integrity and confidentiality.

Affected Version(s)

Omada Access Points 0

Omada Gateways 0

Omada Switches 0

References

https://support.omadanetworks.com/en/download/firmware/
patch
https://support.omadanetworks.com/us/download/firmware/
patch
https://www.tp-link.com/us/support/faq/5216/
vendor-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies
.