Veille CVE

Recherche « TP-Link Systems Inc OC200 v3 »

7 CVE

Critique 0 Élevée 3 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « TP-Link Systems Inc OC200 v3 » ✕
  1. CVE-2026-84941 6.9 Moyenne

    TP-Link Systems Inc. Omada Software Controller (Windows) · TP-Link Systems Inc. Omada Software Controller (Linux) · TP-Link Systems Inc. OC2000 v1 · TP-Link Systems Inc. OC2000 v2

    An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

  2. CVE-2026-81531 6.9 Moyenne

    TP-Link System Inc. Omada Software Controller · TP-Link Systems Inc. OC200 V1 · TP Link Systems Inc. OC200 v2 · TP-Link Systems Inc OC200 v3

    An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.  Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

  3. CVE-2025-15630 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

  4. CVE-2025-15629 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

  5. CVE-2025-15628 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

  6. CVE-2025-15627 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

  7. CVE-2025-15544 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc. Omada App

    A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.