Vulnerability Intelligence Report
Weak Credential Storage in TP-Link Omada Devices
CVE-2025-15631
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
No Active Exploit Signals
CVSS Base Score
5.7
MEDIUM
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-759 ↗CWE-759 Use of a One-Way hash without a salt
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| TP-Link Systems Inc. | Omada Gateways | 0 (affected) |
| TP-Link Systems Inc. | Omada Switches | 0 (affected) |
| TP Link Systems Inc. | Omada Access Points | 0 (affected) |
| TP-Link Systems Inc. | Omada OLTs | 0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | TP-Link Systems Inc. · Vendor · USA |
| Reserved | 2026-04-10T16:33:57 |
| Published | 2026-08-03T17:51:52 |
| Last Updated | 2026-08-03T18:29:33 |
Community Chatter & Buzz