PatchTheCVECVE-2025-9291: A certification validation weakness exists in communication between affected Omada devices and cloud controlle
CVE-2025-9291 is a medium-severity flaw (CVSS 6.5) affecting omada fusion 2.5g firmware, omada er707-m2 firmware, omada er7206 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between aff
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2026-08-03 |
| Last modified | 2026-09-29 |
Last updated 2026-09-29 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-9291?
omada fusion 2.5g firmware: mitigate or apply the listed mitigation; omada er707-m2 firmware: mitigate or apply the listed mitigation; omada er7206 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-9291 being exploited?
CVE-2025-9291 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-9291 affect?
CVE-2025-9291 affects omada fusion 2.5g firmware, omada er707-m2 firmware, omada er7206 firmware. Severity is medium (CVSS 6.5). A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud
How urgent is CVE-2025-9291?
Priority 31/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-15627 HIGH 7.5 MITIGATE MITIGATE A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptograph
- CVE-2025-15629 HIGH 7.5 MITIGATE MITIGATE A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect c
- CVE-2025-15628 HIGH 7.5 MITIGATE MITIGATE Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust bet
- CVE-2025-15544 MEDIUM 5.9 MITIGATE MITIGATE A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credent
- CVE-2025-15630 MEDIUM 5.9 MITIGATE MITIGATE A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to inter