PatchTheCVECVE-2025-15631: A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy
CVE-2025-15631 is a medium-severity flaw (CVSS 5.9) affecting omada fusion 2.5g firmware, omada er707-m2 firmware, omada er7206 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-759 |
| Published | 2026-08-03 |
| Last modified | 2026-09-29 |
Last updated 2026-09-29 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-15631?
omada fusion 2.5g firmware: mitigate or apply the listed mitigation; omada er707-m2 firmware: mitigate or apply the listed mitigation; omada er7206 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-15631 being exploited?
CVE-2025-15631 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-15631 affect?
CVE-2025-15631 affects omada fusion 2.5g firmware, omada er707-m2 firmware, omada er7206 firmware. Severity is medium (CVSS 5.9). A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data m
How urgent is CVE-2025-15631?
Priority 31/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-15627 HIGH 7.5 MITIGATE MITIGATE A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptograph
- CVE-2025-15629 HIGH 7.5 MITIGATE MITIGATE A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect c
- CVE-2025-15628 HIGH 7.5 MITIGATE MITIGATE Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust bet
- CVE-2025-15544 MEDIUM 5.9 MITIGATE MITIGATE A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credent
- CVE-2025-15630 MEDIUM 5.9 MITIGATE MITIGATE A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to inter