{"id":"CVE-2025-15631","state":"PUBLISHED","title":"Weak Credential Storage in TP-Link Omada Devices","description":"A\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential data may be able to recover valid credentials\nto gain unauthorized access to affected devices or management environments.","publishedAt":"2026-08-03T17:51:52.265Z","updatedAt":"2026-08-03T18:29:33.225Z","severity":{"score":5.7,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"TPLink"},"assigner":"TPLink","products":["TP-Link Systems Inc. Omada Gateways","TP-Link Systems Inc. Omada Switches","TP Link Systems Inc. Omada Access Points","TP-Link Systems Inc. Omada OLTs"],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Omada Gateways","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Switches","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP Link Systems Inc.","product":"Omada Access Points","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada OLTs","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]}],"references":["https://www.omadanetworks.com/us/support/download/","https://www.omadanetworks.com/en/support/download/","https://www.tp-link.com/us/support/faq/5216/"],"weaknesses":["CWE-759"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15631.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15631","state":"PUBLISHED","datePublished":"2026-08-03T17:51:52.265Z","dateUpdated":"2026-08-03T18:29:33.225Z","assignerShortName":"TPLink","assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateReserved":"2026-04-10T16:33:57.776Z"},"containers":{"cna":{"title":"Weak Credential Storage in TP-Link Omada Devices","descriptions":[{"lang":"en","value":"A\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential data may be able to recover valid credentials\nto gain unauthorized access to affected devices or management environments."}],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Omada Gateways","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Switches","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP Link Systems Inc.","product":"Omada Access Points","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada OLTs","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://www.omadanetworks.com/us/support/download/","tags":["patch"]},{"url":"https://www.omadanetworks.com/en/support/download/","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/faq/5216/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.7,"vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-759","lang":"en","description":"CWE-759 Use of a One-Way hash without a salt","type":"CWE"}]}],"providerMetadata":{"shortName":"TPLink","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateUpdated":"2026-08-03T17:51:52.265Z"},"impacts":[{"capecId":"CAPEC-55","descriptions":[{"lang":"en","value":"CAPEC-55 Rainbow Table Password Cracking"}]}],"credits":[{"lang":"en","value":"Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T18:29:21.933159Z","id":"CVE-2025-15631","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-03T18:29:33.225Z"}}]}}}