Loading vulnerability…
Improper Certificate Hostname Validation in TP-Link Omada and Festa VPN Routers
CVE-2025-9291 is a certificate validation flaw affecting TP-Link Omada and Festa VPN routers, and potentially other related devices that use the same trust logic for controller communications. The vulnerability arises because client devices do not adequately verify that the identity presented in a controller certificate matches the expected cloud controller hostname. Reported details indicate insufficient Common Name checking during controller certificate validation, allowing certificate identity verification to be bypassed under specific conditions. As a result, a device may accept a certificate that is trusted or otherwise appears valid but does not correctly correspond to the intended controller endpoint, weakening the authenticity guarantees of the TLS connection between the device and its cloud controller.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can enable a man-in-the-middle position between affected devices and their cloud controllers. An attacker who can present a certificate that passes the flawed validation logic may intercept, observe, or modify management traffic exchanged during controller communications. Depending on what is transmitted over that channel, this can undermine the integrity and confidentiality of provisioning or management operations and may facilitate broader compromise when combined with other weaknesses in the affected ecosystem.
If you can’t patch tonight, do this now.
Until patched versions are fully deployed, reduce exposure by limiting opportunities for adversaries to position themselves on the communication path between devices and controllers. Prefer trusted and segmented management networks, restrict untrusted network access, monitor controller communication paths for anomalies, and review device-management traffic for signs of interception or unexpected certificate behavior. Where operationally feasible, minimize reliance on exposed or untrusted network paths for controller connectivity and follow vendor guidance for hardening affected deployments.
Patch, then assume compromise.
Apply TP-Link firmware and software updates for affected Omada and Festa products as provided by the vendor. Because the weakness is in certificate identity verification logic, remediation requires vendor-supplied fixes that enforce proper hostname validation against the expected cloud controller identity during TLS certificate checks. Organizations should also update any related controller software or dependent components identified by TP-Link as affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.