TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network management ecosystem, disclosing that the flaws can be chained with two previously known vulnerabilities to achieve full remote code execution (RCE) and allow attackers to completely compromise managed networks.
The disclosure covers a broad swath of the Omada product line — controllers, gateways, switches, access points, OLT platforms, the Omada and Omada Guard mobile apps (combined ~1.1 million downloads), IP cameras, and smart home IoT devices.
What Is Omada ZTP?
Zero-touch provisioning is a mechanism that allows Omada network devices to be automatically adopted, configured, and managed by the Omada controller without manual on-site setup. Devices connect to the controller during initial boot, authenticate, and receive their configuration automatically. This makes large-scale network deployments significantly simpler — but it also creates an automated trust relationship that attackers can abuse if the adoption process is not properly secured.
The Vulnerability Chain
The 15 newly patched flaws span four impact categories:
| Category | Impact |
|---|---|
| Client-side code execution | JavaScript injection enabling phishing of admin credentials |
| Information disclosure | Exposure of configuration data, MAC addresses, and password hashes |
| Device hijacking / spoofing | Impersonation of legitimate devices during adoption |
| Encrypted communications compromise | Extraction of VPN keys and other secrets |
Eleven of the flaws received CVE identifiers: CVE-2025-9289 through CVE-2025-9293, CVE-2025-15544, and CVE-2025-15627 through CVE-2025-15631. Four additional vulnerabilities were not assigned CVE numbers; they relate to device adoption via serial numbers, default credentials, predictable identifiers, and unauthenticated file downloads.
When chained with two previously disclosed vulnerabilities — CVE-2025-7850 and CVE-2025-7851 — these flaws can result in full remote code execution on affected devices and controllers.
Attack Chain: How a Network Gets Compromised
The attack exploits weaknesses in the ZTP device adoption race condition:
1. Attacker enumerates predictable device serial numbers
2. Serial numbers are used to obtain MAC addresses
3. Attacker impersonates a legitimate Omada device
4. Device authenticates using default or predictable credentials
5. Configuration data is extracted — including unsalted MD5 password hashes and VPN keys
6. JavaScript injection phishes administrator credentials via the management console
7. Full network reconfiguration achieved with stolen admin access
8. Chain with CVE-2025-7850/7851 for RCE on controllerThe attack does not require physical access to the network. The ZTP mechanism is designed to work over the internet for remote deployments, which means the attack surface can be externally accessible.
Affected Products
The vulnerabilities affect a wide range of Omada ecosystem products:
- Controllers: Omada Software Controller, Omada Hardware Controller
- Gateways: ER series enterprise gateways
- Switches: TL-SG series managed switches
- Access Points: EAP series wireless access points
- OLT Platforms: Omada-managed fiber infrastructure
- Cloud Services: Omada cloud-based management
- Mobile Apps: Omada app (~1.1M combined downloads) and Omada Guard
- IoT Devices: TP-Link IP cameras and smart home devices
Remediation
TP-Link has released firmware updates through its Omada download portal. Organizations should:
- Apply firmware updates for all affected Omada controllers, gateways, switches, and access points
- Update the Omada and Omada Guard mobile apps to the latest versions
- Replace default credentials with strong, unique passwords on all devices
- Enable multi-factor authentication on the Omada controller
- Rotate secrets — VPN keys, controller passwords, and API tokens — if compromise is suspected
- Monitor for anomalous device adoption activity — unexpected devices attempting to join the network
Why This Matters
The Omada ecosystem is a popular choice for small and medium-sized businesses, retail environments, and campus deployments. The ZTP mechanism's value — enabling large, zero-touch rollouts — creates exactly the kind of automated trust that attackers target. A single compromised serial number in a predictable range can cascade into full network control.
The breadth of affected products (controllers, switches, APs, cameras, mobile apps) means organizations need to patch across their entire Omada deployment, not just individual device categories. The combination of JavaScript injection for credential phishing, unsalted MD5 password hashes, and the ability to chain with pre-existing RCE CVEs makes this a high-severity event despite not receiving immediate widespread attention.
Source: BleepingComputer