CVE-2025-15627mediumCWE-321

CVE-2025-15627: medium-severity vulnerability in TP Link Systems Inc. Omada Access Points

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

Published

Follow this CVE+ Monitor Omada Gateways+ Monitor Omada Access Points

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.7%
A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
TP Link Systems Inc. · Omada Access PointsTP-Link Systems Inc · Omada ControllersTP-Link Systems Inc. · Omada GatewaysTP-Link Systems Inc. · Omada Switches
Related CVEs — TP Link Systems Inc. Omada Access Points

In the same product, most dangerous first.

CVE-2025-15544MEDIUMWeak Credential Protection During TP-Link Omada Device AdoptionEPSS 0.3%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2025-15630MEDIUMDevice Provisioning Race Condition in TP-Link Omada Adoption WorkflowEPSS 0.3%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.3%CVE-2025-9291HIGHImproper Certificate Validation in TP-Link Omada Cloud CommunicationsEPSS 0.2%