CVE-2025-9293
Published: 13 February 2026
Summary
CVE-2025-9293 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Tp-Link Aginet. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates management and validation of PKI certificates to prevent acceptance of untrusted or improperly validated server identities in TLS communications.
Requires timely remediation of flaws like this certificate validation vulnerability through patching or updates as per vendor advisories.
Ensures cryptographic protection for transmission confidentiality and integrity, mitigating interception and modification risks from MiTM attacks exploiting poor certificate validation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper certificate validation (CWE-295) directly enables successful Adversary-in-the-Middle attacks by allowing an on-path attacker to present untrusted certificates that the client will accept, facilitating traffic interception and modification.
NVD Description
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position…
more
themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
Deeper analysisAI
CVE-2025-9293 is a vulnerability in the certificate validation logic that may allow applications to accept untrusted or improperly validated server identities during TLS communication. It affects products from vendors including TP-Link and Omada Networks, as detailed in their respective advisories. Classified under CWE-295 (Improper Certificate Validation), the issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-13.
An attacker in a privileged network position who can position themselves within the communication channel may exploit this vulnerability to intercept or modify traffic. No privileges or user interaction are required, though high attack complexity is involved, likely due to the need for such positioning. Successful exploitation can compromise the confidentiality, integrity, and availability of application data.
Vendor advisories provide guidance on mitigation. Details are available from Omada Networks at https://www.omadanetworks.com/us/support/faq/4969/ and from TP-Link at https://www.tp-link.com/us/support/faq/4969/.
Details
- CWE(s)