{"id":"CVE-2025-9291","state":"PUBLISHED","title":"Improper Certificate Validation in TP-Link Omada Cloud Communications","description":"A\ncertification validation weakness exists in communication between affected\nOmada devices and cloud controllers. Certificate identity verification does not\nadequately validate that a presented certificate corresponds to the expected\ncloud controller hostname, which may allow certificate validation protections\nto be bypassed under specific conditions.\n\n\n\n\n\nSuccessful\nexploitation may allow interception or modification of communication between\naffected devices and cloud controllers.","publishedAt":"2026-08-03T17:48:14.707Z","updatedAt":"2026-08-05T03:57:07.728Z","severity":{"score":7.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"TPLink"},"assigner":"TPLink","products":["TP-Link Systems Inc. Omada Gateways","TP-Link Systems Inc. Omada Switches","TP-Link Systems Inc. Omada Access Points"],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Omada Gateways","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Switches","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Access Points","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]}],"references":["https://support.omadanetworks.com/en/download/firmware/","https://support.omadanetworks.com/us/download/firmware/","https://www.tp-link.com/us/support/faq/5216/"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9291.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-9291","state":"PUBLISHED","datePublished":"2026-08-03T17:48:14.707Z","dateUpdated":"2026-08-05T03:57:07.728Z","assignerShortName":"TPLink","assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateReserved":"2025-08-20T22:24:22.941Z"},"containers":{"cna":{"title":"Improper Certificate Validation in TP-Link Omada Cloud Communications","descriptions":[{"lang":"en","value":"A\ncertification validation weakness exists in communication between affected\nOmada devices and cloud controllers. Certificate identity verification does not\nadequately validate that a presented certificate corresponds to the expected\ncloud controller hostname, which may allow certificate validation protections\nto be bypassed under specific conditions.\n\n\n\n\n\nSuccessful\nexploitation may allow interception or modification of communication between\naffected devices and cloud controllers."}],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Omada Gateways","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Switches","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]},{"vendor":"TP-Link Systems Inc.","product":"Omada Access Points","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://support.omadanetworks.com/en/download/firmware/","tags":["patch"]},{"url":"https://support.omadanetworks.com/us/download/firmware/","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/faq/5216/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.7,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","lang":"en","description":"CWE-295 Improper certificate validation","type":"CWE"}]}],"providerMetadata":{"shortName":"TPLink","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateUpdated":"2026-08-03T17:48:14.707Z"},"impacts":[{"capecId":"CAPEC-94","descriptions":[{"lang":"en","value":"CAPEC-94 Adversary in the Middle (AiTM)"}]}],"credits":[{"lang":"en","value":"Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-04T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2025-9291"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-05T03:57:07.728Z"}}]}}}