Loading vulnerability…
Weak password hash protection in TP-Link Omada and Festa VPN routers
CVE-2025-15631 is a cryptographic weakness affecting TP-Link Omada and Festa VPN routers in which device-management passwords are stored as unsalted MD5 hashes and protected with a hard-coded encryption key. The use of a legacy hash algorithm without salting provides insufficient resistance to offline recovery, and the additional encryption layer does not adequately compensate because the key is static and embedded. If an attacker obtains the stored credential material from affected devices or associated management workflows, the attacker may be able to recover valid site or device-management credentials and use them to access affected devices or management environments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose valid administrative or site-management credentials through offline recovery of stored password material. Recovered credentials can enable unauthorized access to affected devices, controllers, or related management environments. In broader attack chains, access to these credentials may facilitate device takeover, configuration changes, exposure of additional sensitive configuration data, establishment of unauthorized VPN connectivity, and further compromise of managed network infrastructure.
If you can’t patch tonight, do this now.
Until remediation is fully deployed, restrict access to stored credential data and management interfaces, minimize exposure of controllers and devices to untrusted networks, and enforce strong unique passwords for device and controller administration. Enable multi-factor authentication where supported, monitor for unauthorized administrative access, and review affected environments for signs of credential misuse. If compromise is suspected, immediately change credentials and review dependent trust relationships and remote-access configurations.
Patch, then assume compromise.
Apply TP-Link firmware and software updates that address CVE-2025-15631 for affected Omada and Festa products. Replace the weak credential-protection scheme with a modern password hashing approach using unique per-password salts and an adaptive password hashing algorithm. After patching, rotate potentially exposed device-management and site credentials, and rotate any related secrets that may have been accessible through the same management context.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.