CVE-2025-9291 HIGH

CVE-2025-9291: Improper Certificate Validation in TP-Link Omada Cloud Communications

Vendor Tp-Link Systems Inc.
Product Omada Gateways
Weakness CWE-295
Published August 3, 2026
Last update August 3, 2026

CVSS base score

7.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

Key dates

02Disclosure timeline

August 3, 2026 CVE published