Read the docs
TI-2025-06718 Aliases CVE-2025-7375GHSA-8rjq-jcxh-mp3r

Unauthenticated Denial-of-Service Vulnerability in Omada EAP610

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610 firmware versions prior to 1.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed EAP610 v3 (TP-Link Systems Inc.): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkEAP610 v3before 1.6.01.6.0Patch availableCNA
  • EAP610 v3 VendorTP-Link Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:omada_eap610_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableTP-Link
cpe:2.3:h:tp-link:omada_eap610:3:*:*:*:*:*:*:*3Running onTP-Link
  • cpe:2.3:o:tp-link:omada_eap610_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:omada_eap610:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link

Remediation

  • Fix · CNA EAP610 v3 (TP-Link Systems Inc.) Fixed in 1.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7375
  2. 2026-10-03 Alias added: GHSA-8rjq-jcxh-mp3r

References

Patch 2

Advisory 1

  • TI-2025-14256 Hardcoded Certificates in TP-Link Omada Device Communications CVSS 4.0HIGH 8.2
  • TI-2025-08516 Improper Certificate Validation in TP-Link Omada Cloud Communications CVSS 4.0HIGH 7.7
  • TI-2025-14255 Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication CVSS 4.0MEDIUM 6.9
  • TI-2025-14257 Weak Session Key Generation in TP-Link Omada Adoption Protocol CVSS 4.0MEDIUM 6.9
  • TI-2025-14183 Weak Credential Protection During TP-Link Omada Device Adoption CVSS 4.0MEDIUM 6.9
  • TI-2025-14258 Device Provisioning Race Condition in TP-Link Omada Adoption Workflow CVSS 4.0MEDIUM 5.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences