CVE-2025-15630

MediumCVSS 5.9/10Last modified Sep 29, 2026

Description

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-156315.9A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does no CVE-2025-156323.5A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component CVE-2025-156336.5An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access intern CVE-2025-156344.3A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environm CVE-2025-156354.3Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forg CVE-2025-156366.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtub CVE-2025-156378.1Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-1563810.0Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versi CVE-2025-15649.8The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not pro CVE-2025-156416.8Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privile CVE-2025-156426.8Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can l CVE-2025-156437.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b