TP-Link Omada: 15 ZTP Vulnerabilities Could Open the Door to Enterprise Networks

Flaws in Zero-Touch Provisioning

TP-Link has fixed 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism used across the Omada ecosystem. The analysis was conducted by Forescout Vedere Labs.

The issues affect Omada controllers, gateways, switches, access points, and OLT platforms, as well as TP-Link, Omada, and Omada Guard cloud services and mobile applications. The scope also includes other devices, such as IP cameras and consumer IoT products.

Eleven vulnerabilities have been assigned CVE identifiers:

• CVE-2025-9289–CVE-2025-9293;
• CVE-2025-15544;
• CVE-2025-15627–CVE-2025-15631.

Four additional flaws have not been assigned CVE identifiers. No CVSS score has been published.

An Attack Chain Can Lead to RCE

The vulnerabilities can be chained with CVE-2025-7850 and CVE-2025-7851, two previously disclosed command injection flaws. In this scenario, an attacker can turn client-side code execution into a broader compromise, potentially leading to remote code execution (RCE).

The reported impacts include:

• device hijacking or spoofing;
• access to configurations, credentials, and VPN keys;
• compromise of encrypted communications;
• theft of cloud credentials through JavaScript injected into the administrative interface;
• configuration changes;
• creation of VPN tunnels into internal networks;
• network access through controllers and client devices.

Forescout identified more than 1,800 Omada controllers accessible from the Internet. One of the analyzed scenarios combines predictable serial numbers, device impersonation, a race condition during cloud adoption, and default credentials.

The controller can therefore become an entry point into normally unexposed internal segments, particularly when it manages equipment deployed across multiple sites.

What Administrators Should Do

Firmware updates should be installed through the official Omada portal, with each affected model verified. Organizations should also update the TP-Link mobile applications associated with their infrastructure.

Organizations should:

• use strong, unique administrative credentials;
• enable multifactor authentication;
• remove controllers from direct Internet exposure;
• rotate passwords, VPN keys, and other secrets if compromise is suspected;
• monitor for anomalous access, new configurations, and unexpected VPN tunnels.

Applying patches alone does not rule out prior exposure: Omada networks should also be checked for unauthorized changes and credentials that may already have been stolen.