Riskcovery

CVE-2025-15627

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

State
Published
Severity
6.9 Medium
Published
Aug 3, 2026
Updated
Aug 3, 2026
Reserved
Apr 10, 2026

Read the record on cve.org

Description

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption.

An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:NTPLink

Weaknesses

  • CWE-321 Use of hard-coded cryptographic key

Affected Products

ProductVersions
Omada GatewaysTP-Link Systems Inc.
  • 0Affected
Omada SwitchesTP-Link Systems Inc.
  • 0Affected
Omada Access PointsTP Link Systems Inc.
  • 0Affected
Omada ControllersTP-Link Systems Inc
  • 0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.