Veille CVE

Recherche « TP-Link Systems Inc. Omada Gateways »

9 CVE

Critique 1 Élevée 4 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « TP-Link Systems Inc. Omada Gateways » ✕
  1. CVE-2026-19683 7.4 Élevée

    TP-Link Systems Inc. ER7212PC v2 · TP-Link Systems Inc. ER605 v2 · TP-Link Systems Inc. ER7206 v2 · TP-Link Systems Inc ER7406 v1

    A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.  Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

  2. CVE-2026-19586 9.8 Critique

    TP-Link Systems Inc. ER7212PC v2 · TP-Link Systems Inc. ER605 v2 · TP-Link Systems Inc. ER7206 v2 · TP-Link Systems Inc ER7406 v1

    A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.  Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

  3. CVE-2025-15631 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc. Omada OLTs

    A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

  4. CVE-2025-15630 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

  5. CVE-2025-15629 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

  6. CVE-2025-15628 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

  7. CVE-2025-15627 7.5 Élevée

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

  8. CVE-2025-15544 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc. Omada App

    A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

  9. CVE-2025-9291 6.5 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP-Link Systems Inc. Omada Access Points · Tp-link omada fusion 2.5g firmware

    A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.