CVE-2025-15628

HighCVSS 7.5/10Last modified Sep 29, 2026

Description

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices.

An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-156297.5A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllCVE-2025-156305.9A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflowCVE-2025-156315.9A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does noCVE-2025-156323.5A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component CVE-2025-156336.5An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internCVE-2025-156344.3A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmCVE-2025-156354.3Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request ForgCVE-2025-156366.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtubCVE-2025-156378.1Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-1563810.0Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versiCVE-2025-15649.8The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not proCVE-2025-156416.8Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privile
CVE-2025-15628: High severity, CVSS 7.5 | Vulnix