CVE-2025-7375 - CVE House

Back to Database

Status published Medium CVE-2025-7375

Unauthenticated Denial-of-Service Vulnerability in Omada EAP610

6.9 CVSS

Vulnerability Description

A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610 firmware versions prior to 1.6.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-7375

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Felix Thümmler

References

More from TP-Link Systems Inc.

View All →

Authenticated RCE by CWMP binary

Blind Server-Side Request Forgery (SSRF) in Omada Controller

Password Confirmation Bypass in Omada Controller

IDOR Leading to Owner Account Hijacking in Omada Controller

Authenticated RCE via Parental Control command injection

Affected Vendor

TP-Link Systems Inc.

View all reports →

Affected Software

EAP610 v3

Vulnerable Versions:

0

Timeline

Official Publish: March 5th, 2026

Last Modified: March 6th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation