Loading vulnerability…
Hard-coded TLS Certificate and Private Key in TP-Link Omada Protocol v2
CVE-2025-15628 is a cryptographic trust vulnerability in TP-Link Omada hardware and software controllers and related Omada device communications. Version 2 of the Omada protocol relies on an embedded TLS server certificate and corresponding private key that are shared across deployments rather than being uniquely generated per installation or device set. Because these credentials are hard-coded and reused, the trust relationship between controllers and managed devices can be undermined if the embedded certificate material is recovered. An attacker in possession of the shared certificate and private key may be able to impersonate a trusted controller or managed device and position themselves within communications that are expected to be authenticated and encrypted.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the chain of trust between Omada controllers and managed devices. An attacker may be able to spoof trusted infrastructure, perform man-in-the-middle interception of affected communications, and gain access to sensitive management traffic exchanged during controller-device interactions. Depending on deployment context, this can enable disclosure of configuration or operational data and facilitate follow-on attacks that rely on impersonating legitimate Omada components.
If you can’t patch tonight, do this now.
Until full remediation is completed, reduce exposure of controller-device communications to untrusted networks, restrict management-plane reachability, and segment provisioning and controller traffic from user-accessible or hostile network segments. Monitor for anomalous controller or device impersonation behavior and unexpected certificate use. Where supported, implement certificate pinning or stricter certificate validation for controller communications, and rotate credentials or secrets that may have been exposed through interception of affected traffic.
Patch, then assume compromise.
Apply TP-Link updates, firmware, and controller software releases that replace the shared embedded certificate model with corrected trust material handling for affected products. Where vendor guidance supports it, update embedded certificates, rotate any compromised certificate material, and redeploy trust anchors so controllers and managed devices no longer rely on shared credentials across installations. Review affected Omada and related product lines for patches because the issue may extend to products that share the same certificate trust components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.