PT-2026-67460 · Tp Link Systems · Omada Access Point+3

CVE-2025-15629 · Published 2026-08-03 · Updated 2026-08-03

NVD

CVSS v4.0

6.9

Medium

Base vector

AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation.

An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2025-15629

Affected Products

Omada Access Point

Omada Controller

Omada Gateways

Omada Switches

References · 4

• https://omadanetworks.com/us/support/download · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15629 · Security Note
• https://tp-link.com/us/support/faq/5216 · Vendor Advisory
• https://omadanetworks.com/en/support/download · Patch