Strix
26.1K

CVE-2025-15631

MEDIUMCVSS 5.9/10EPSS 0.10%

Last modified

CVE-2025-15631 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.. EPSS estimates a 0.10% chance of exploitation in the next 30 days.

Description

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
5.7/10

CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.10%

1.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Tp-LinkOmada Fusion 2.5g FirmwareAll versions
Tp-LinkOmada Er707-M2 FirmwareAll versions
Tp-LinkOmada Er7206 FirmwareAll versions
Tp-LinkOmada Er706w FirmwareAll versions
Tp-LinkOmada Er8411 FirmwareAll versions
Tp-LinkOmada Er605 FirmwareAll versions
Tp-LinkOmada Er7412-M2 FirmwareAll versions
Tp-LinkOmada Er706w-4g FirmwareAll versions
Tp-LinkOmada Er703wp-4g-Outdoor FirmwareAll versions
Tp-LinkOmada Er706wp-4g FirmwareAll versions
Tp-LinkOmada S7500-24y4c FirmwareAll versions
Tp-LinkOmada S7500-26xf6y FirmwareAll versions
Tp-LinkOmada S6500-48mpp6y FirmwareAll versions
Tp-LinkOmada S6500-24mpp4y FirmwareAll versions
Tp-LinkOmada S6500-48gp6xf FirmwareAll versions
Tp-LinkOmada S6500-48g6xf FirmwareAll versions
Tp-LinkOmada S6500-24gp4xf FirmwareAll versions
Tp-LinkOmada S6500-24g4xf FirmwareAll versions
Tp-LinkOmada Sx6632yf FirmwareAll versions
Tp-LinkOmada Sx3032f FirmwareAll versions
Tp-LinkOmada Sx3016f FirmwareAll versions
Tp-LinkOmada Sx3008f FirmwareAll versions
Tp-LinkOmada Sg3428xf FirmwareAll versions
Tp-LinkOmada Sx3832mpp FirmwareAll versions
Tp-LinkOmada Sx3832 FirmwareAll versions
Tp-LinkOmada Sx3206hpp FirmwareAll versions
Tp-LinkOmada Sg3428xpp-M2 FirmwareAll versions
Tp-LinkOmada Sg3428x-M2 FirmwareAll versions
Tp-LinkOmada Sg3218xp-M2 FirmwareAll versions
Tp-LinkOmada Sg3210xhp-M2 FirmwareAll versions
Tp-LinkOmada Sg3210x-M2 FirmwareAll versions
Tp-LinkOmada Sg2210xmp-M2 FirmwareAll versions
Tp-LinkOmada Sg6654xhp FirmwareAll versions
Tp-LinkOmada Sg6654x FirmwareAll versions
Tp-LinkOmada Sg6428xhp FirmwareAll versions
Tp-LinkOmada Sg6428x FirmwareAll versions
Tp-LinkOmada Sg5452xmpp FirmwareAll versions
Tp-LinkOmada Sg5452x FirmwareAll versions
Tp-LinkOmada Sg5428xmpp FirmwareAll versions
Tp-LinkOmada Sg5428x FirmwareAll versions
Tp-LinkOmada Sg3452xmpp FirmwareAll versions
Tp-LinkOmada Sg3452xp FirmwareAll versions
Tp-LinkOmada Tl-Sg3452x FirmwareAll versions
Tp-LinkOmada Sg3428xmpp FirmwareAll versions
Tp-LinkOmada Sg3428xmp FirmwareAll versions
Tp-LinkOmada Sg3428x FirmwareAll versions
Tp-LinkOmada Sg2005p-Pd FirmwareAll versions
Tp-LinkOmada Sg3452p FirmwareAll versions
Tp-LinkOmada Sg3452 FirmwareAll versions
Tp-LinkOmada Sg3428mp FirmwareAll versions

Showing 50 of 109 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-15631?
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
How severe is CVE-2025-15631?
CVE-2025-15631 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 0.10% probability of exploitation in the next 30 days.
How do I fix CVE-2025-15631?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-15631?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST