Is there a patch available for CVE-2025-15627?

Yes, a patch is available for CVE-2025-15627. Update the affected software to the latest version immediately.

TP-Link Omada CVE-2025-15627

Q: What is the CVSS score of CVE-2025-15627?

CVE-2025-15627 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210609 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-08-03 TPLink

GHSA-wwx9-ww39-c5vg

Information Disclosure Omada Gateways Omada Switches Omada Access Points Omada Controllers

6.9

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Adjacent vector for L2 positioning; AC:H for timing dependency on active adoption; UI:R for required admin trigger; scope changed as impact crosses controller-to-device boundary.

3.1 AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:04 vuln.today

CVE Published

Aug 03, 2026 - 17:49 cve.org

MEDIUM 6.9

DescriptionCVE.org

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption.

An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

AnalysisAI

Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.

Technical ContextAI

The Omada adoption protocol is the mechanism by which TP-Link Omada controllers (software or hardware) discover and onboard managed network devices such as access points, switches, and gateways. CWE-321 (Use of Hard-coded Cryptographic Key) describes the root cause: rather than generating unique per-device or per-installation keys, the firmware embeds a static shared secret used to authenticate and encrypt adoption exchanges. An attacker who reverse-engineers any Omada firmware image can extract these keys and replay or forge adoption messages. Affected CPEs span all versions of four product families: cpe:2.3:a:tp-link_systems_inc.:omada_gateways, omada_switches, omada_access_points, and omada_controllers - indicating no version of any Omada product line is immune without the vendor patch.

RemediationAI

Apply the vendor-released firmware and software updates available through the TP-Link Omada download portal (https://www.omadanetworks.com/us/support/download/) and consult the security advisory at https://www.tp-link.com/us/support/faq/5216/ for specific patched versions for each affected product line. Exact patched version numbers are not independently confirmed from the available data and must be retrieved from the vendor portal. As a compensating control prior to patching, restrict device adoption operations to a dedicated, tightly access-controlled management VLAN that is isolated from user-accessible segments, reducing the attacker's ability to achieve adjacent-network positioning. Additionally, schedule adoption events during controlled maintenance windows with minimal personnel on the management network to reduce the exposure window. Avoid performing device adoption on shared or untrusted network segments. Note that VLAN isolation reduces but does not eliminate risk if the attacker already has access to the management segment.