Loading vulnerability…
Race Condition in TP-Link Omada Cloud Device Adoption
CVE-2025-15630 is a race condition in the cloud-based device adoption workflow used by TP-Link Omada controllers. During zero-touch or cloud onboarding, an attacker can interact with the adoption process before the legitimate device completes registration and, by spoofing the target device identity such as its MAC address, win the registration handshake. If successful, the controller may deliver provisioning information intended for the legitimate device to the attacker-controlled system. Reported exposed data includes initial configuration material and other sensitive provisioning information associated with the device onboarding process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose provisioning information intended for a legitimate device. Reported exposed data may include sensitive configuration material such as administrator credential hashes, site credentials, and VPN-related secrets, depending on deployment and controller behavior. This can enable follow-on compromise of managed infrastructure, including unauthorized access to controller-managed environments and further attacks against enrolled network equipment.
If you can’t patch tonight, do this now.
Until full remediation is in place, reduce exposure of the adoption workflow by tightly controlling which devices are allowed to onboard, monitoring adoption events for anomalies, and investigating unexpected or duplicate registration attempts. Limit direct internet exposure of management infrastructure, enforce strong administrator credentials and multifactor authentication for associated accounts, rotate provisioning-related secrets and VPN keys if compromise is suspected, and use segmentation and network access controls to reduce the ability of attackers to interfere with onboarding traffic or pivot after disclosure.
Patch, then assume compromise.
Apply TP-Link updates for affected Omada controllers, devices, and related software components as provided by the vendor. Where patches are available, upgrade cloud, software, and hardware controller components involved in device adoption so the onboarding workflow no longer permits attacker-controlled registration races or spoofed device enrollment. After patching, rotate any credentials, hashes, or VPN secrets that may have been exposed during prior adoption events.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.