---
cve: "CVE-2025-9291"
severity: "HIGH"
cvss: 7.7
epss: "13%"
vendor: "TP-Link Systems Inc."
kev: false
exploited: false
published: "2026-08-03 18:16:34"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T05:38:56+02:00"
---

# CVE-2025-9291

> 7.7 HIGH

## Beschreibung

A
certification validation weakness exists in communication between affected
Omada devices and cloud controllers. Certificate identity verification does not
adequately validate that a presented certificate corresponds to the expected
cloud controller hostname, which may allow certificate validation protections
to be bypassed under specific conditions.





Successful
exploitation may allow interception or modification of communication between
affected devices and cloud controllers.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |

## Referenzen

- <https://support.omadanetworks.com/en/download/firmware/>
- <https://support.omadanetworks.com/us/download/firmware/>
- <https://www.tp-link.com/us/support/faq/5216/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-9291) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_