Loading vulnerability…
Authentication weakness in TP-Link Omada protocol v2 adoption
CVE-2025-9290 is an authentication weakness affecting TP-Link Omada controllers, gateways, access points, and related hardware, software, and cloud-based controller deployments during controller-device adoption. Omada protocol version 2 does not ensure that salt values used in credential authentication are unique or non-empty. As a result, credential-derived values can become static and predictable enough to support offline precomputation, weakening the intended freshness of the authentication exchange. An attacker in a sufficiently privileged network position can intercept adoption traffic, leverage the improper handling of random values, and forge valid authentication for the adoption process. The weakness can expose static credential hashes and undermine confidentiality of provisioning-related communications.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker with the necessary network position to intercept controller-device adoption traffic and forge valid authentication during the adoption workflow. This can expose sensitive information associated with provisioning and authentication, including static credential hashes, and compromises the confidentiality of the controller-device trust relationship. In broader attack chains against the Omada zero-touch provisioning ecosystem, such weaknesses can contribute to device impersonation, unauthorized access to configuration data, and follow-on compromise of managed infrastructure.
If you can’t patch tonight, do this now.
Until patched versions are fully deployed, restrict and segment controller-device adoption traffic to trusted management networks only, and prevent untrusted hosts from obtaining Layer 2 or Layer 3 access to provisioning paths. Avoid exposing controllers unnecessarily, tightly control onboarding environments, and monitor for anomalous adoption attempts, unexpected device-authentication events, or signs of interception during provisioning. As additional compensating controls, use strong unique credentials, enable multifactor authentication for management accounts where supported, and review whether any provisioning-related secrets require rotation.
Patch, then assume compromise.
Upgrade affected TP-Link Omada controllers, gateways, access points, and related controller software or cloud-managed components to vendor-fixed versions once available from TP-Link. Apply all Omada firmware, controller, and application updates associated with the coordinated fixes for the zero-touch provisioning vulnerabilities. Because the weakness can expose credential-derived material, rotate affected administrative and device-management credentials after patching, and replace any other secrets that may have been exposed during adoption or provisioning workflows.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.