Description
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.
Affected products
tp-link: omada fusion 2.5g firmware; tp-link: omada fusion 2.5g; tp-link: omada er707-m2 firmware; tp-link: omada er707-m2; tp-link: omada er7206 firmware; tp-link: omada er7206; tp-link: omada er706w firmware; tp-link: omada er706w; tp-link: omada er8411 firmware; tp-link: omada er8411; tp-link: omada er605 firmware; tp-link: omada er605; tp-link: omada er7412-m2 firmware; tp-link: omada er7412-m2; tp-link: omada er706w-4g firmware
References3
- www.tp-link.com/us/support/faq/5216/ Vendor Advisory
- support.omadanetworks.com/en/download/firmware/ Product
- support.omadanetworks.com/us/download/firmware/ Product
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 4.0
-
7.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 12 · as of 13 November 2026
- CWE
- CWE-295
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.