TP-Link Omada CVE-2025-15544

Exploitation requires the attacker to be positioned on the same network segment as the Omada management traffic at the time a device adoption event is actively occurring - meaning a network administrator must be in the process of onboarding a new device to the controller (CVSS UI:P). The attacker must have traffic-capture capability on the management segment, either through passive sniffing or an ARP/man-in-the-middle position (CVSS AC:H, AT:P). No prior authentication to the Omada system is required (PR:N). Key limiting factors: remote internet-based exploitation is impossible due to the adjacency constraint (AV:A); the adoption event window must coincide with attacker presence; and the time-to-crack depends heavily on the complexity of the site management password, meaning strong passwords raise the bar for offline recovery even after interception.

The CVSS 4.0 score of 6.9 with vector AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N encodes several meaningful risk limiters: adjacency requirement (AV:A) prevents internet-based exploitation; high attack complexity (AC:H) and attack prerequisites (AT:P) mean the attacker must be well-positioned on the management segment with traffic-capture capability; and user interaction (UI:P) means an adoption event must be in progress. The high confidentiality impact on subsequent systems (SC:H) correctly captures that recovered credentials unlock access to the entire Omada-managed infrastructure, not just a single device. No CISA KEV listing and no public POC identified at time of analysis, meaning this is not under opportunistic mass exploitation. The realistic threat actor is an insider or someone with physical or logical access to the management VLAN - not a remote internet attacker. Priority should be elevated in environments with flat or poorly segmented management networks where the adoption process is performed frequently.

An attacker with a foothold on the Omada management network segment - via a rogue device, compromised host, or physical switch port access - uses passive traffic capture while a network administrator initiates the adoption of a new Omada device. The captured adoption exchange contains weakly-hashed site management credentials; the attacker applies precomputed rainbow tables or GPU-accelerated brute-force offline to recover the plaintext password. With those credentials, the attacker authenticates to the Omada controller, gaining administrative visibility and control over all managed gateways, switches, and access points in the environment.