Loading vulnerability…
Weak credential hashing in TP-Link Omada device adoption
CVE-2025-15544 is a cryptographic weakness in the TP-Link Omada device adoption process affecting Omada hardware, software, and cloud-based controllers. During adoption, site-management authentication credentials are transmitted using a weak hashing algorithm that does not provide adequate protection against recovery by an attacker observing the exchange. Reported attack scenarios indicate that adoption-related configuration data may expose a plaintext username together with an unsalted MD5-derived credential value, making the credential material significantly easier to crack or reuse if intercepted. The flaw weakens trust in the onboarding workflow and can contribute to broader compromise of controller-managed environments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to intercept adoption-related authentication traffic may recover valid site-management credentials and use them to gain unauthorized access to managed devices or controller-managed environments. Successful exploitation can expose administrative access to the controller ecosystem, enable reconfiguration of managed network equipment, and facilitate follow-on actions such as unauthorized management operations, network pivoting, or use in multi-step attack chains against Omada infrastructure.
If you can’t patch tonight, do this now.
Until remediation is fully deployed, reduce exposure of adoption traffic to interception by restricting onboarding to trusted management networks, isolating provisioning workflows from untrusted segments, and avoiding unnecessary internet exposure of controllers. Use strong unique administrator credentials, enable multi-factor authentication where supported, monitor for suspicious adoption or controller activity, and treat credentials used or transmitted during prior adoption events as potentially compromised. Additional defensive value comes from segmenting controller access and closely auditing newly adopted devices and management sessions.
Patch, then assume compromise.
Apply TP-Link updates for affected Omada hardware, software controllers, and cloud-managed components as provided by the vendor. After patching, rotate any site-management credentials that may have been exposed during device adoption, and replace any related secrets that were distributed through affected onboarding workflows. Review controller and device configurations for unauthorized changes and re-enroll devices through updated software where appropriate.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.