TP-Link Omada EAP100-Bridge KIT v1.0 hash predictable salt

Summaryinfo

A vulnerability classified as problematic has been found in TP-Link Omada Software Controller, Omada Cloud Controller, Omada Hardware Controller, Omada Hardware Controller OC220, Omada Gateway, Omada Gateway ER7212PC 2.0, Omada Festa Gateway FR365, Omada Gateway G36W-4G, Omada Access Point EAP, Omada Access Point, Omada Beam Bridge 5 UR v1.0, Omada Access Point , EAP650-Desktop v1.0 and Omada EAP100-Bridge KIT v1.0. Affected is an unknown function. Performing a manipulation results in hash predictable salt. This vulnerability is known as CVE-2025-9290. Access to the local network is required for this attack. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in TP-Link Omada Software Controller, Omada Cloud Controller, Omada Hardware Controller, Omada Hardware Controller OC220, Omada Gateway, Omada Gateway ER7212PC 2.0, Omada Festa Gateway FR365, Omada Gateway G36W-4G, Omada Access Point EAP, Omada Access Point, Omada Beam Bridge 5 UR v1.0, Omada Access Point , EAP650-Desktop v1.0 and Omada EAP100-Bridge KIT v1.0. This affects some unknown processing. The manipulation with an unknown input leads to a hash predictable salt vulnerability. CWE is classifying the issue as CWE-760. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input. This is going to have an impact on confidentiality. The summary by CVE is:

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

The weakness was published by Stanislav Dashevskyi and Francesco La Spina. It is possible to read the advisory at support.omadanetworks.com. This vulnerability is uniquely identified as CVE-2025-9290 since 08/21/2025. The exploitability is told to be difficult. Access to the local network is required for this attack to succeed. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1110.002 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• TP-Link

Name

• EAP650-Desktop v1.0
• Omada Access Point
• Omada Access Point
• Omada Access Point EAP
• Omada Beam Bridge 5 UR v1.0
• Omada Cloud Controller
• Omada EAP100-Bridge KIT v1.0
• Omada Festa Gateway FR365
• Omada Gateway
• Omada Gateway ER7212PC 2.0
• Omada Gateway G36W-4G
• Omada Hardware Controller
• Omada Hardware Controller OC220
• Omada Software Controller

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion