TP-Link Patches 15 Vulnerabilities in the ZTP Mechanism of Omada Devices

TP-Link has released fixes for 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada line of networking equipment. Chained with previously disclosed flaws, they can lead to remote code execution. The vulnerabilities were discovered by researchers at Forescout Vedere Labs, who presented the full details at the Black Hat USA conference.

Omada is TP-Link's line of business equipment: Wi-Fi access points, switches, internet gateways and VPN routers. It is typically used by small and medium-sized companies, but the vendor also offers enterprise-grade solutions. The ZTP mechanism eliminates the need to configure each device manually on site: the IT department or service provider prepares the configuration remotely.

What the researchers found

Some of the 15 vulnerabilities also affect other TP-Link products — IP cameras, smart home devices, mobile apps and cloud accounts. The issues include hardcoded cryptographic keys, information leaks, remote code execution, device spoofing and takeover, as well as interception of encrypted traffic. Eleven of the flaws received identifiers (CVE-2025-9289 — CVE-2025-9293, CVE-2025-15544 and others), while four remain unnumbered: they concern admitting a device to the network by serial number alone, default credentials, predictable serial numbers, and files accessible via temporary links without authentication.

Attack scenario

Forescout describes a clear-cut scheme. An attacker brute-forces predictable serial numbers, obtains MAC addresses and finds devices waiting to connect. He then impersonates one of them, exploits a race condition during cloud connection and logs in with default credentials. In response, the controller hands over the device configuration — a plaintext login, an unsalted MD5 hash of the password and, possibly, VPN keys.

Next, the attacker injects JavaScript into the controller's admin interface to phish the administrator's cloud management credentials. Once he has them, he can reconfigure the equipment, bring up VPN tunnels into the internal network and, by leveraging previously disclosed command injection vulnerabilities, compromise the networking hardware.

The flaws affect controllers, gateways, switches, access points, OLT platforms, Omada cloud services and TP-Link mobile apps. Forescout found more than 1,800 Omada controllers exposed to the internet — even though such deployments generally are not meant to be directly connected to the network.

Users are advised to download the latest firmware from the TP-Link portal, set strong unique administrator passwords, enable multi-factor authentication, rotate all secrets if compromise is suspected, update mobile apps and watch for suspicious traffic.

Source: Bleeping Computer