Strix
26.1K

CVE-2025-9290

MEDIUMCVSS 5.9/10EPSS 0.20%

Last modified

CVE-2025-9290 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
6/10

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.20%

10.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Tp-LinkOmada Controller< 6.0.0.24
Tp-LinkOmada Controller< 6.0.0.100
Tp-LinkOc200 Firmware< 1.37.9
Tp-LinkOc220 Firmware< 1.1.3
Tp-LinkOc300 Firmware< 1.31.9
Tp-LinkOc400 Firmware< 1.9.9
Tp-LinkOc200 Firmware< 2.22.9
Tp-LinkOc220 FirmwareAll versions
Tp-LinkEr605 Firmware< 2.3.2
Tp-LinkEr7206 Firmware< 2.2.2
Tp-LinkEr7406 Firmware< 1.2.2
Tp-LinkEr707-M2 Firmware< 1.3.1
Tp-LinkEr7412-M2 Firmware< 1.1.0
Tp-LinkEr8411 Firmware< 1.3.5
Tp-LinkEr706w Firmware< 1.2.1
Tp-LinkEr706w-4g Firmware< 1.2.1
Tp-LinkEr706wp-4g Firmware< 1.1.0
Tp-LinkEr703wp-4g-Outdoor Firmware< 1.1.0
Tp-LinkDr3220v-4g Firmware< 1.1.0
Tp-LinkDr3650v-4g Firmware< 1.1.0
Tp-LinkDr3650v Firmware< 1.1.0
Tp-LinkEr701-5g-Outdoor Firmware< 1.0.0
Tp-LinkEr605w Firmware< 2.0.2
Tp-LinkEr7212pc Firmware< 2.2.1
Tp-LinkFr365 Firmware< 1.1.10
Tp-LinkG36w-4g Firmware< 1.1.5
Tp-LinkEap655-Wall Firmware< 1.6.2
Tp-LinkEap660 Hd Firmware< 1.6.1
Tp-LinkEap620 Hd Firmware< 1.6.1
Tp-LinkEap610-Outdoor Firmware< 1.6.1
Tp-LinkEap610 Firmware< 1.6.1
Tp-LinkEap623-Outdoor Hd Firmware< 1.6.1
Tp-LinkEap625-Outdoor Hd Firmware< 1.6.1
Tp-LinkEap772 Firmware< 1.3.2
Tp-LinkEap772-Outdoor Firmware< 1.3.2
Tp-LinkEap770 Firmware< 1.3.2
Tp-LinkEap723 Firmware< 1.3.2
Tp-LinkEap773 Firmware< 1.1.2
Tp-LinkEap783 Firmware< 1.1.2
Tp-LinkEap772 Firmware< 1.1.2
Tp-LinkEap787 Firmware< 1.1.2
Tp-LinkEap720 Firmware< 1.1.2
Tp-LinkEap723 Firmware< 1.1.2
Tp-LinkEap725-Wall Firmware< 1.1.2
Tp-LinkEap215 Bridge Kit Firmware< 1.1.4
Tp-LinkEap211 Bridge Kit Firmware< 1.1.4
Tp-LinkBeam Bridge 5 Ur Firmware< 1.1.5
Tp-LinkEap603gp-Desktop Firmware< 1.1.0
Tp-LinkEap615gp-Wall Firmware< 1.1.0
Tp-LinkEap625gp-Wall Firmware< 1.1.0

Showing 50 of 64 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-9290?
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
How severe is CVE-2025-9290?
CVE-2025-9290 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2025-9290?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-9290?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST