TP-Link Omada CVE-2025-15627

The attacker must have adjacent network access (Layer-2 presence on the same segment as the Omada controller and a managed device). Device adoption must be actively in progress - AT:P in the CVSS 4.0 vector confirms a specific attack requirement is present, meaning the attacker cannot exploit this at arbitrary times but must time the attack to coincide with an adoption event. Passive user interaction is required (UI:P), meaning an administrator must initiate or allow the adoption process. The attacker must have prior access to the hard-coded keys, obtainable by reverse-engineering any Omada firmware image from the public download portal. Exploitation is limited to confidentiality impact on adoption-related communications - the CVSS vector shows VI:N and VA:N, meaning integrity and availability of systems are not directly affected. Non-default deployment modes or configurations are not required; any standard Omada adoption workflow is affected.

The CVSS 4.0 score of 6.9 reflects a realistic but constrained attack surface: AV:A limits exploitation to attackers already positioned on the same Layer-2 network segment, AT:P signals that a specific window (active device adoption) must be present, and UI:P indicates passive user interaction is required (someone must trigger or allow adoption). The high confidentiality impact on both vulnerable systems (VC:H) and subsequent systems (SC:H) reflects that intercepted adoption credentials could grant the attacker persistent access to management communications across the Omada ecosystem. There is no KEV listing and no POC has been identified, so exploitation probability appears low in the near term. The primary realistic threat is insider or adjacent-network adversaries in SMB or campus environments during network provisioning windows. EPSS data is not available in the provided input, so probability quantification cannot be confirmed. The CVSS 4.0 AT:P and UI:P constraints are important mitigating factors that reduce opportunistic mass exploitation risk - this is not a fire-and-forget remote vulnerability.

An attacker with access to the same network segment as an Omada controller and a managed device - for example, a rogue insider or a compromised host on the management VLAN - extracts hard-coded cryptographic keys from publicly available Omada firmware images. When an administrator triggers adoption of a new switch or access point, the attacker uses the extracted keys to inject forged adoption protocol messages, impersonating the controller to the device or vice versa, and captures the sensitive authentication credentials exchanged during the adoption handshake. No public POC has been identified at time of analysis.