TP-Link Omada ZTP flaws enable controller hijacking and full network takeover

Forescout disclosed 15 vulnerabilities in TP-Link’s Omada zero-touch provisioning ecosystem that can be chained to compromise managed device fleets, hijack controllers and devices, and potentially take over entire networks. The flaws span hardcoded cryptographic material, insecure credential transmission, weak certificate validation, a cloud adoption race condition, cross-site scripting, predictable serial numbers, and default credentials; 11 received CVE identifiers. Researchers said the chain can be combined with previously disclosed remote code execution bugs CVE-2025-7850 and CVE-2025-7851 to achieve administrative control and possible root-level command execution on Omada devices, while identifying roughly 1,800 internet-exposed Omada controllers.

One of the disclosed issues, CVE-2025-15628, carries a CVSS 4.0 score of 8.2 and involves hardcoded certificates shared across Omada deployments, creating a path for attackers who obtain the certificates to impersonate trusted controllers or devices and intercept communications. TP-Link’s advisory portal shows broad ongoing remediation activity across Omada and other product lines, and the company has issued patches and advisories for some of the newly reported weaknesses; however, some structural fixes are not expected until later in 2026 and certain lower-severity issues will remain unpatched. Researchers also warned that related weaknesses may extend beyond Omada to other TP-Link families including VIGI, Festa, Tapo, and Kasa.