Threat Investigation
Request a demo

CVE-2025-9290

Medium

Description

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

SeverityMedium
CVSS5.9
Exploit probability—
ProductTp-link Omada Controller
PublishedJan 23, 2026
First seenJan 23, 2026
Weakness typeCWE-760CWE-760

How to fix

Update
  • tp-link omada_controller6.0.0.24, 6.0.0.100, 6.0.0.34, 5.15.24 or later
  • tp-link oc200_firmware1.37.9, 2.22.9 or later
  • tp-link oc220_firmware1.1.3 or later
  • tp-link oc300_firmware1.31.9 or later
  • tp-link oc400_firmware1.9.9 or later
  • tp-link er605_firmware2.3.2 or later
  • tp-link er7206_firmware2.2.2 or later
  • tp-link er7406_firmware1.2.2 or later
  • tp-link er707-m2_firmware1.3.1 or later
  • tp-link er7412-m2_firmware1.1.0 or later
  • tp-link er8411_firmware1.3.5 or later
  • tp-link er706w_firmware1.2.1 or later
Patches
Vendor advisories

Affected products

ProductAffected versionsFixed in
tp-link omada_controllerv < 6.0.0.24, v < 6.0.0.100, v < 6.0.0.34, v < 5.15.246.0.0.24, 6.0.0.100, 6.0.0.34, 5.15.24
tp-link oc200_firmwarev < 1.37.9, v < 2.22.91.37.9, 2.22.9
tp-link oc220_firmwarev < 1.1.3, No range specified1.1.3
tp-link oc300_firmwarev < 1.31.91.31.9
tp-link oc400_firmwarev < 1.9.91.9.9
tp-link er605_firmwarev < 2.3.22.3.2
tp-link er7206_firmwarev < 2.2.22.2.2
tp-link er7406_firmwarev < 1.2.21.2.2
tp-link er707-m2_firmwarev < 1.3.11.3.1
tp-link er7412-m2_firmwarev < 1.1.01.1.0
tp-link er8411_firmwarev < 1.3.51.3.5
tp-link er706w_firmwarev < 1.2.11.2.1
tp-link er706w-4g_firmwarev < 1.2.1, v < 2.1.01.2.1, 2.1.0
tp-link er706wp-4g_firmwarev < 1.1.01.1.0
tp-link er703wp-4g-outdoor_firmwarev < 1.1.01.1.0
tp-link dr3220v-4g_firmwarev < 1.1.01.1.0
tp-link dr3650v-4g_firmwarev < 1.1.01.1.0
tp-link dr3650v_firmwarev < 1.1.01.1.0
tp-link er701-5g-outdoor_firmwarev < 1.0.01.0.0
tp-link er605w_firmwarev < 2.0.22.0.2
tp-link er7212pc_firmwarev < 2.2.12.2.1
tp-link fr365_firmwarev < 1.1.101.1.10
tp-link g36w-4g_firmwarev < 1.1.51.1.5
tp-link eap655-wall_firmwarev < 1.6.21.6.2
tp-link eap660_hd_firmwarev < 1.6.11.6.1
tp-link eap620_hd_firmwarev < 1.6.11.6.1
tp-link eap610-outdoor_firmwarev < 1.6.11.6.1
tp-link eap610_firmwarev < 1.6.11.6.1
tp-link eap623-outdoor_hd_firmwarev < 1.6.11.6.1
tp-link eap625-outdoor_hd_firmwarev < 1.6.11.6.1
tp-link eap772_firmwarev < 1.3.2, v < 1.1.21.3.2, 1.1.2
tp-link eap772-outdoor_firmwarev < 1.3.21.3.2
tp-link eap770_firmwarev < 1.3.21.3.2
tp-link eap723_firmwarev < 1.3.2, v < 1.1.21.3.2, 1.1.2
tp-link eap773_firmwarev < 1.1.21.1.2
tp-link eap783_firmwarev < 1.1.21.1.2
tp-link eap787_firmwarev < 1.1.21.1.2
tp-link eap720_firmwarev < 1.1.21.1.2
tp-link eap725-wall_firmwarev < 1.1.21.1.2
tp-link eap215_bridge_kit_firmwarev < 1.1.41.1.4
tp-link eap211_bridge_kit_firmwarev < 1.1.41.1.4
tp-link beam_bridge_5_ur_firmwarev < 1.1.51.1.5
tp-link eap603gp-desktop_firmwarev < 1.1.01.1.0
tp-link eap615gp-wall_firmwarev < 1.1.01.1.0
tp-link eap625gp-wall_firmwarev < 1.1.01.1.0
tp-link eap610gp-desktop_firmwarev < 1.1.01.1.0
tp-link eap650gp-desktop_firmwarev < 1.0.11.0.1
tp-link eap653_firmwarev < 1.3.31.3.3
tp-link eap650-outdoor_firmwarev < 1.3.31.3.3
tp-link eap230-wall_firmwarev < 3.3.13.3.1
tp-link eap235-wall_firmwarev < 3.3.13.3.1
tp-link eap603-outdoor_firmwarev < 1.5.11.5.1
tp-link eap653_ur_firmwarev < 1.4.21.4.2
tp-link eap650-desktop_firmwarev < 1.1.01.1.0
tp-link eap615-wall_firmwarev < 1.1.01.1.0
tp-link eap100-bridge_kit_firmwarev < 1.0.31.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.