TP-Link Omada CVE-2025-15628

Exploitation requires the attacker to first obtain the shared embedded certificate material, which can be extracted from any Omada-family device's firmware (gateways, switches, APs, OLTs, or controllers) - this is the primary enabling condition. The attacker must then achieve adjacent network positioning on the Omada management network segment (AV:A), such as by compromising a host that can reach controller-to-device communication paths or by physically connecting to the management VLAN. The CVSS 4.0 UI:P qualifier indicates a managed device must initiate a connection to the rogue controller (passive interaction), but this occurs automatically in normal Omada polling behavior and does not require any administrator action. Exploitation is NOT limited to specific configuration settings or non-default deployment modes - the shared certificate design is inherent to all Omada firmware. The meaningful limiting factor is network adjacency: attackers without access to the Omada management segment cannot exploit this remotely over the internet.

The CVSS 4.0 score of 8.2 with AV:A (adjacent network) meaningfully bounds real-world exposure: exploitation requires the attacker to already have a foothold on the same network segment as Omada management traffic, limiting mass internet exploitation. However, once adjacent, AC:L and AT:N confirm the attack itself is straightforward with no exploit complexity - certificate possession is the only gate. The UI:P qualifier in CVSS 4.0 (passive interaction) suggests a victim device or controller must initiate a connection, which is expected behavior in normal Omada controller-device polling, making this practically exploitable without any user action in typical deployments. High confidentiality impact on both vulnerable (VC:H) and subsequent (SC:H) systems reflects that intercepted management traffic likely contains credentials, network topology, and device configurations. No EPSS score was provided in the source data, and the CVE is not in the CISA KEV catalog, so exploitation probability signals are limited to the CVSS vector analysis. The authentication-bypass tag and shared-certificate design mean a single compromised or publicly leaked firmware image could expose all Omada customers - a supply-chain-style amplifier that elevates real-world risk above what the AV:A vector alone implies.

An attacker with access to any Omada device - acquired legitimately, via purchase, or by exploiting a separate vulnerability - extracts the shared embedded certificate from its firmware. The attacker then connects to a target organization's Omada management network segment (via a compromised host, rogue device, or physical access) and stands up a rogue controller presenting the extracted certificate. Managed Omada devices authenticate the rogue controller as trusted and begin reporting to it, enabling the attacker to intercept management traffic including network credentials and configuration data. No public proof-of-concept code has been identified at time of analysis, but firmware extraction from TP-Link devices is a documented research activity.