TP-Link released security advisories to address security flaws in Omada devices. A malicious actor could exploit these vulnerabilities (CVE-2025-9291, CVE-2025-15544, CVE-2025-15627, CVE-2025-15628, CVE-2025-15629, CVE-2025-15630 and CVE-2025-15631) to trigger security restriction bypass, spoofing and sensitive information disclosure on the targeted system. The manufacturer has released patches to eliminate vulnerabilities in its products:

Omada Controllers, Omada Gateways, Omada Switches, Omada Access Points, Omada OLTs, Omada App.

Source: omadanetworks.com