Strix
26.1K

CVE-2025-15629

HIGHCVSS 7.5/10EPSS 0.10%

Last modified

CVE-2025-15629 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.. EPSS estimates a 0.10% chance of exploitation in the next 30 days.

Description

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
6.9/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.10%

1.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Tp-LinkOmada Oc200 V3 FirmwareAll versions
Tp-LinkOmada Oc300 FirmwareAll versions
Tp-LinkOmada Oc400 FirmwareAll versions
Tp-LinkOmada Fusion 2.5g FirmwareAll versions
Tp-LinkOmada Er707-M2 FirmwareAll versions
Tp-LinkOmada Er7206 FirmwareAll versions
Tp-LinkOmada Er706w FirmwareAll versions
Tp-LinkOmada Er8411 FirmwareAll versions
Tp-LinkOmada Er605 FirmwareAll versions
Tp-LinkOmada Er7412-M2 FirmwareAll versions
Tp-LinkOmada Er706w-4g FirmwareAll versions
Tp-LinkOmada Er703wp-4g-Outdoor FirmwareAll versions
Tp-LinkOmada Er706wp-4g FirmwareAll versions
Tp-LinkOmada S7500-24y4c FirmwareAll versions
Tp-LinkOmada S7500-26xf6y FirmwareAll versions
Tp-LinkOmada S6500-48mpp6y FirmwareAll versions
Tp-LinkOmada S6500-24mpp4y FirmwareAll versions
Tp-LinkOmada S6500-48gp6xf FirmwareAll versions
Tp-LinkOmada S6500-48g6xf FirmwareAll versions
Tp-LinkOmada S6500-24gp4xf FirmwareAll versions
Tp-LinkOmada S6500-24g4xf FirmwareAll versions
Tp-LinkOmada Sx6632yf FirmwareAll versions
Tp-LinkOmada Sx3032f FirmwareAll versions
Tp-LinkOmada Sx3016f FirmwareAll versions
Tp-LinkOmada Sx3008f FirmwareAll versions
Tp-LinkOmada Sg3428xf FirmwareAll versions
Tp-LinkOmada Sx3832mpp FirmwareAll versions
Tp-LinkOmada Sx3832 FirmwareAll versions
Tp-LinkOmada Sx3206hpp FirmwareAll versions
Tp-LinkOmada Sg3428xpp-M2 FirmwareAll versions
Tp-LinkOmada Sg3428x-M2 FirmwareAll versions
Tp-LinkOmada Sg3218xp-M2 FirmwareAll versions
Tp-LinkOmada Sg3210xhp-M2 FirmwareAll versions
Tp-LinkOmada Sg3210x-M2 FirmwareAll versions
Tp-LinkOmada Sg2210xmp-M2 FirmwareAll versions
Tp-LinkOmada Sg6654xhp FirmwareAll versions
Tp-LinkOmada Sg6654x FirmwareAll versions
Tp-LinkOmada Sg6428xhp FirmwareAll versions
Tp-LinkOmada Sg6428x FirmwareAll versions
Tp-LinkOmada Sg5452xmpp FirmwareAll versions
Tp-LinkOmada Sg5452x FirmwareAll versions
Tp-LinkOmada Sg5428xmpp FirmwareAll versions
Tp-LinkOmada Sg5428x FirmwareAll versions
Tp-LinkOmada Sg3452xmpp FirmwareAll versions
Tp-LinkOmada Sg3452xp FirmwareAll versions
Tp-LinkOmada Tl-Sg3452x FirmwareAll versions
Tp-LinkOmada Sg3428xmpp FirmwareAll versions
Tp-LinkOmada Sg3428xmp FirmwareAll versions
Tp-LinkOmada Sg3428x FirmwareAll versions
Tp-LinkOmada Sg2005p-Pd FirmwareAll versions

Showing 50 of 112 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-15629?
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.
How severe is CVE-2025-15629?
CVE-2025-15629 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.10% probability of exploitation in the next 30 days.
How do I fix CVE-2025-15629?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-15629?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST