Veille CVE
CVE-2025-9291
6.5 MoyenneDescription
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.
Produits concernés
- TP-Link Systems Inc. Omada Gateways
- TP-Link Systems Inc. Omada Switches
- TP-Link Systems Inc. Omada Access Points
- Tp-link omada fusion 2.5g firmware
- Tp-link omada er707-m2 firmware
- Tp-link omada er7206 firmware
- Tp-link omada er706w firmware
- Tp-link omada er8411 firmware
- Tp-link omada er605 firmware
- Tp-link omada er7412-m2 firmware
- Tp-link omada er706w-4g firmware
- Tp-link omada er703wp-4g-outdoor firmware
- Tp-link omada er706wp-4g firmware
- Tp-link omada s7500-24y4c firmware
- Tp-link omada s7500-26xf6y firmware
- Tp-link omada s6500-48mpp6y firmware
- Tp-link omada s6500-24mpp4y firmware
- Tp-link omada s6500-48gp6xf firmware
- Tp-link omada s6500-48g6xf firmware
- Tp-link omada s6500-24gp4xf firmware
- Tp-link omada s6500-24g4xf firmware
- Tp-link omada sx6632yf firmware
- Tp-link omada sx3032f firmware
- Tp-link omada sx3016f firmware
- Tp-link omada sx3008f firmware
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 7.7 Élevée | f23511db-6c3e-4e32-a477-6aa17d310630 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 6.5 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |