TP-Link Omada Products Multiple Vulnerabilities
Details
Original advisory: https://www.hkcert.org/security-bulletin/tp-link-omada-products-multiple-vulnerabilities_20260805
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-92910.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.
- Low exploitation riskCVE-2025-155440.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
- Low exploitation riskCVE-2025-156270.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
- Low exploitation riskCVE-2025-156280.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
- Low exploitation riskCVE-2025-156290.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
- Low exploitation riskCVE-2025-156300.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
- Low exploitation riskCVE-2025-156310.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-9291 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15544 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15627 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15628 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15629 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15630 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-15631 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownCVE-2025-15631: A cryptographic weakness exists in affected Omada devices where site credentials are protected…nvd
- unknownCVE-2025-15630: A race condition exists in the cloud-based Omada device adoption process when an attacker may …nvd
- unknownCVE-2025-15629: A cryptographic weakness exists in the Omada adoption protocol where session encryption keys u…nvd
- unknownCVE-2025-15628: Affected Omada devices rely on embedded certificates that are shared across deployments to est…nvd
- unknownCVE-2025-15627: A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-co…nvd
- unknownCVE-2025-15544: A cryptographic weakness exists in the Omada device adoption process. During adoption, authent…nvd
- unknownCVE-2025-9291: A certification validation weakness exists in communication between affected Omada devices and …nvd
More from HKCERT Security Bulletins
- unknownApache Tomcat Multiple Vulnerabilities2026-08-05
- unknownMozilla Firefox Information Disclosure Vulnerability2026-08-05
- unknownSUSE Linux Kernel Multiple Vulnerabilities2026-08-04
- unknownMicrosoft Edge Multiple Vulnerabilities2026-08-03
- unknownRedHat Linux Kernel Multiple Vulnerabilities2026-08-03