TP-Link Patches 15 Omada ZTP Vulnerabilities Allowing Network Breaches

Vulnerabilities in Omada ZTP Mechanism

TP-Link has addressed 15 vulnerabilities within the zero-touch provisioning (ZTP) mechanism of its Omada network devices. These security flaws were identified by Forescout’s Vedere Labs researchers and publicly detailed at the Black Hat USA security conference.

Omada is TP-Link's product line for business networking, encompassing Wi-Fi access points, Ethernet switches, internet gateways, and VPN routers. These devices are commonly deployed in small to medium-sized businesses and enterprise environments.

Potential for Remote Code Execution

The discovered vulnerabilities, when combined with two previously disclosed command-injection flaws (CVE-2025-7850 and CVE-2025-7851), could allow attackers to achieve remote code execution (RCE). This chain of exploits could compromise Omada’s chain of trust and enable infiltration of networks.

The issues include hard-coded cryptographic keys, information disclosure, device hijacking and spoofing, client-side code execution, and the interception or compromise of encrypted communications. Some of these vulnerabilities also extend to other TP-Link products, such as IP cameras, smart home IoT devices, mobile applications, and cloud accounts.

Identified CVEs and Other Findings

TP-Link's advisory lists 11 of the 15 newly disclosed flaws with CVE identifiers, including CVE-2025-9289 through CVE-2025-9293, CVE-2025-15544, and CVE-2025-15627 through CVE-2025-15631.

The remaining four findings, which did not receive CVE tracking numbers, involve device adoption based solely on serial numbers, default credentials used during initial adoption, predictable serial numbers, and files accessible via unauthenticated temporary download links. Forescout described a scenario where a remote attacker could enumerate predictable device serial numbers to identify devices awaiting adoption.