CVE-2025-15630mediumCWE-362

CVE-2025-15630: medium-severity vulnerability in TP Link Systems Inc. Omada Access Points

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

Published

Follow this CVE+ Monitor Omada Gateways+ Monitor Omada Access Points

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.8epss 0.3%
A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
TP Link Systems Inc. · Omada Access PointsTP-Link Systems Inc · Omada ControllersTP-Link Systems Inc. · Omada GatewaysTP-Link Systems Inc. · Omada Switches
Related CVEs — TP Link Systems Inc. Omada Access Points

In the same product, most dangerous first.

CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.7%CVE-2025-15544MEDIUMWeak Credential Protection During TP-Link Omada Device AdoptionEPSS 0.3%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.3%CVE-2025-9291HIGHImproper Certificate Validation in TP-Link Omada Cloud CommunicationsEPSS 0.2%