Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398, 2.3.5 Build 20260625 Rel.43136, 1.3.4 Build 20260625 Rel.43136, 1.4.4 Build 20260625 Rel.43063, and 14 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- TP-Link Systems Inc. ER7212PC v2
fixed in 2.4.3 Build 20260722 Rel.40250
- TP-Link Systems Inc. ER605 v2
fixed in 2.4.4 Build 20260630 Rel.14398
- TP-Link Systems Inc. ER7206 v2
fixed in 2.3.5 Build 20260625 Rel.43136
- TP-Link Systems Inc ER7406 v1
fixed in 1.3.4 Build 20260625 Rel.43136
- TP-Link Systems Inc. ER707-M2 v1
fixed in 1.4.4 Build 20260625 Rel.43063
- TP-Link Systems Inc ER7412-M2 v1
fixed in 1.2.0 Build 20260630 Rel.82947
- TP-Link Systems Inc. ER8411 v1
fixed in 1.4.1 Build 20260708 Rel.64832
- TP-Link Systems Inc. ER706W v1
fixed in 1.2.11 Build 20260723 Rel.41567
- TP-Link Systems Inc. v1
fixed in 1.2.6 Build 20260723 Rel.41321
- TP-Link Systems Inc. ER706W-4G v2
fixed in 2.1.11 Build 20260723 Rel.41624
- TP-Link Systems Inc. ER706WP-4G v1
fixed in 1.1.11 Build 20260723 Rel.41624
- TP-Link Systems Inc. ER703WP-4G-Outdoor v1
fixed in 1.1.7 Build 20260723 Rel.41712
- TP-Link Systems Inc. DR3220v-4G v1
fixed in 1.2.0 Build 20260630 Rel.82652
- TP-Link Systems Inc. DR3650v v1
fixed in 1.2.0 Build 20260630 Rel.83311
- TP-Link Systems Inc. DR3650v-4G v1
fixed in 1.2.0 Build 20260630 Rel.83347
- TP-Link Systems Inc. ER603WP-4G-Outdoor v1
fixed in 1.0.2 Build 20260723 Rel.43271
- TP-Link Systems Inc. DR3150 v1
fixed in 1.0.1 Build 20260722 Rel.16854
- TP-Link Systems Inc. ER701-5G-Outdoor v1
fixed in 1.0.3 Build 20260723 Rel.40931
- TP-Link Systems Inc. ER605W v2
fixed in 2.0.4 Build 20260723 Rel.43763