CVE-2025-9291: TP-Link Omada DS1008X Firmware

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

Affected products

  • TP-Link Omada DS1008X Firmware: affected versions not specified
  • TP-Link Omada DS1016G Firmware: affected versions not specified
  • TP-Link Omada DS1016GE Firmware: affected versions not specified
  • TP-Link Omada DS1018GMP Firmware: affected versions not specified
  • TP-Link Omada DS1024G Firmware: affected versions not specified
  • TP-Link Omada DS105G-m2 Firmware: affected versions not specified
  • TP-Link Omada DS105G Firmware: affected versions not specified
  • TP-Link Omada DS105GE Firmware: affected versions not specified
  • TP-Link Omada DS105GP Firmware: affected versions not specified
  • TP-Link Omada DS105X Firmware: affected versions not specified
  • TP-Link Omada DS106GPP Firmware: affected versions not specified
  • TP-Link Omada DS106P Firmware: affected versions not specified
  • TP-Link Omada DS108G-m2 Firmware: affected versions not specified
  • TP-Link Omada DS108G Firmware: affected versions not specified
  • TP-Link Omada DS108GE Firmware: affected versions not specified
  • TP-Link Omada DS108GP Firmware: affected versions not specified
  • TP-Link Omada DS110GMP Firmware: affected versions not specified
  • TP-Link Omada DS111P Firmware: affected versions not specified
  • TP-Link Omada EAP610-Outdoor Firmware: affected versions not specified
  • TP-Link Omada EAP610 Firmware: affected versions not specified
  • TP-Link Omada EAP615-Wall Firmware: affected versions not specified
  • TP-Link Omada EAP620HD Firmware: affected versions not specified
  • TP-Link Omada EAP660HD Firmware: affected versions not specified
  • TP-Link Omada ER605 Firmware: affected versions not specified
  • TP-Link Omada ER703WP-4g-Outdoor Firmware: affected versions not specified
  • and 84 more

Published 2026-08-03. Last modified 2026-09-29.