TP-Link Omada: 15 Zero-Touch Provisioning Flaws Expose…

Forescout discovered 15 vulnerabilities in TP-Link Omada's Zero-Touch Provisioning. An attack chain combining CVE-2025-7850 and CVE-2025-7851 leads to credential theft and full network compromise.

On August 4, 2026, TP-Link released patches for 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism of the Omada platform, used by small and medium businesses to manage switches, access points, and gateways from a single cloud console. The research, conducted by Forescout Vedere Labs and presented at Black Hat USA 2026, demonstrates how the trust chain designed to simplify deployment can be compromised when the new flaws are chained with previously disclosed vulnerabilities.

Key Takeaways

Fifteen flaws in TP-Link Omada's ZTP mechanism, 11 with CVE identifiers, expose the automatic device adoption process.
The documented attack chain includes device impersonation, cleartext credential disclosure and unsalted MD5 hashes, cross-site scripting, and cloud credential theft. Remote code execution as root requires chaining with CVE-2025-7850, a previously disclosed command injection vulnerability.
CVE-2025-7851, also previously disclosed, enables unauthorized SSH root access via residual debug code and represents an alternative escalation path under different conditions.
Over 1,800 Omada controllers are accessible from the internet per Forescout scans, expanding the attack surface beyond the local network.
Data encrypted with AES-256 via a hardcoded key ("who are you?") and shared TLS certificates also expose the VIGI, Festa, Tapo, and Kasa product lines to cross-impersonation risk.

How the Chain Works: From Serial Number to VPN Tunnel

The Zero-Touch Provisioning mechanism is designed to reduce human intervention: a newly powered device automatically registers with the cloud controller and receives configurations, policies, and updates. Forescout demonstrated that this automation inverts into a systemic vector.

The attack begins with serial number enumeration, predictable by structure. From there, the attacker extracts associated MAC addresses, impersonates the device during the cloud adoption phase leveraging default admin/admin credentials, and receives usernames in cleartext and unsalted MD5 password hashes in response. The interface also accepts unsanitized firmware version strings, allowing JavaScript injection for phishing administrator credentials.

With control of the controller, the attacker creates VPN tunnels. At this point, achieving a root shell requires chaining the compromise with CVE-2025-7850: command injection in the WireGuard private key field of the Web UI after administrative authentication. This vulnerability, previously disclosed by Forescout, requires the attacker to have already obtained administrative access to the controller.

CVE-2025-7851, also previously disclosed, enables unauthorized SSH root access via residual debug code in the cli_server binary. According to the National Vulnerability Database, this is improper privilege management, not command injection. It represents an alternative escalation path in scenarios where trigger conditions differ from those of CVE-2025-7850.

Central control means central failure: compromising a controller means inheriting every device it manages — HelpNetSecurity, paraphrasing Forescout analysis

Forescout estimates the enumeration rate required at roughly 17 requests per second to cover a thousand MAC addresses. The severity lies not in a single bug, but in the concatenation of architectural weaknesses that turn every entry point into automatic propagation.

Fifteen Vulnerabilities, Four Without CVE Identifiers

TP-Link assigned 11 CVE identifiers to the new flaws discovered by Forescout. The remaining four — relating to adoption via serial number knowledge, default credentials during initial adoption, predictable serials, and unauthenticated temporary download links — did not receive one, according to BleepingComputer, as the vendor classified them as low severity.

Four CVEs in the dossier have official CVSS 4.0 scores in the National Vulnerability Database. CVE-2025-6542, unauthenticated remote OS command injection, scores 9.3. CVE-2025-7850, command injection via WireGuard private key after administrative authentication, also scores 9.3. CVE-2025-7851, root access via residual debug code in the cli_server binary, is rated 8.7. CVE-2025-6541, command injection by an authenticated user, reaches 8.6.

Verified CVSS 3.1 scores are not available for these vulnerabilities in the materials examined.

Hardcoded Keys and Collision Across Five Product Families

Beyond the 15 ZTP vulnerabilities, Forescout identified a hardcoded AES-256 key with the string "who are you?" for device password encryption, and a TLS certificate with a shared private key across Omada hardware and software controllers. The same certificate chain spans the VIGI (surveillance cameras), Festa (routers), Tapo, and Kasa (smart home) product lines.

The sharing of cryptographic material across five product families expands the risk perimeter beyond the Omada ecosystem. An attacker who compromises the material from a Festa device can impersonate Omada controllers, and vice versa. Passwords are stored as unsalted MD5 hashes, encrypted with AES-256 using the hardcoded key.

Forescout estimated that the Omada and Omada Guard Android apps have 1.1 million downloads on Google Play, while the total active account base across TP-Link apps sits between 3 and 7 million. This installed base amplifies the reach of potential phishing or app impersonation campaigns.

426 Days and Two Flaws Unpatchable via Firmware

Vedere Labs reported the findings to TP-Link in June 2025. Public disclosure occurred 426 days later, during the Black Hat USA 2026 presentation. Two of the vulnerabilities cannot be fixed via firmware update.

According to HelpNetSecurity, TP-Link indicated resolution timelines for manufacturing and logistics issues by Q3 2026. The hardware nature of predictable serials and cryptographic material distribution requires production chain intervention, not just software patches.

What Changes

The Omada case illustrates a recurring pattern in centrally managed network infrastructure: the operational convenience of zero-touch provisioning translates into dependence on a single trust entity. When that entity presents chained flaws, the blast radius exceeds the single device and extends to the entire enterprise network.

The 426 days between reporting and public disclosure, while within coordinated disclosure norms, leave an extended exposure window for operators who do not apply patches promptly. The presence of over 1,800 controllers exposed to the internet, despite Omada architectures not being designed for direct exposure, indicates a discrepancy between presumed design and actual deployment.

The sharing of TLS certificates and encryption keys across five TP-Link product families raises questions about risk segmentation in the Internet of Things. Cross-impersonation between different ecosystems — from VIGI cameras to Omada controllers — requires no new vulnerabilities, only access to the shared cryptographic material.

Closing

TP-Link has released firmware updates for Omada controllers and published an official advisory confirming coordinated disclosure with Forescout. The vendor advisory notes that the practical impact of each vulnerability depends on deployment architecture, and that compromise requires chaining multiple flaws rather than exploiting a single one in isolation.

Eleven of the 15 flaws receive CVE identifiers; seven of these were not specified in the materials available at the time of publication. Four vulnerabilities remain without CVEs, classified by the vendor as low severity. Two require hardware fixes with an estimated timeline of Q3 2026.

Sources: BleepingComputer, HelpNetSecurity, The Hacker News, SecurityWeek, National Vulnerability Database, TP-Link Support

Information verified against cited sources and current as of publication.

Sources

Sources and references