CVE-2025-9290: TP-Link Beam Bridge 5 Ur Firmware

Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days.

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Affected products

• TP-Link Beam Bridge 5 Ur Firmware: before 1.1.5 (fixed in 1.1.5)
• TP-Link DR3220V-4g Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link DR3650V-4g Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link DR3650V Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP100-Bridge Kit Firmware: before 1.0.3 (fixed in 1.0.3)
• TP-Link EAP211 Bridge Kit Firmware: before 1.1.4 (fixed in 1.1.4)
• TP-Link EAP215 Bridge Kit Firmware: before 1.1.4 (fixed in 1.1.4)
• TP-Link EAP230-Wall Firmware: before 3.3.1 (fixed in 3.3.1)
• TP-Link EAP235-Wall Firmware: before 3.3.1 (fixed in 3.3.1)
• TP-Link EAP603-Outdoor Firmware: before 1.5.1 (fixed in 1.5.1)
• TP-Link EAP603GP-Desktop Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP610-Outdoor Firmware: before 1.6.1 (fixed in 1.6.1)
• TP-Link EAP610 Firmware: before 1.6.1 (fixed in 1.6.1)
• TP-Link EAP610GP-Desktop Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP615-Wall Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP615GP-Wall Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP620 Hd Firmware: before 1.6.1 (fixed in 1.6.1)
• TP-Link EAP623-Outdoor Hd Firmware: before 1.6.1 (fixed in 1.6.1)
• TP-Link EAP625-Outdoor Hd Firmware: before 1.6.1 (fixed in 1.6.1)
• TP-Link EAP625GP-Wall Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP650-Desktop Firmware: before 1.1.0 (fixed in 1.1.0)
• TP-Link EAP650-Outdoor Firmware: before 1.3.3 (fixed in 1.3.3)
• TP-Link EAP650GP-Desktop Firmware: before 1.0.1 (fixed in 1.0.1)
• TP-Link EAP653 Firmware: before 1.3.3 (fixed in 1.3.3)
• TP-Link EAP653 Ur Firmware: before 1.4.2 (fixed in 1.4.2)
• and 31 more

Published 2026-01-23. Last modified 2026-10-07.