TP-Link Omada CVE-2025-15629

Exploitation requires the attacker to occupy a network position adjacent to either the Omada Controller or the device being adopted (AV:A), making remote exploitation across routed network boundaries impossible. The attack must be timed to coincide with an active adoption event - the protocol handshake phase during which a new device is being onboarded by the controller - as the cryptographic weakness applies to session key generation at adoption time (AT:P attack conditions). An administrator must initiate the adoption process, introducing a user-interaction dependency (UI:P). No authentication or prior access to the Omada system is required by the attacker (PR:N). Exploitation is limited to confidentiality - there is no integrity or availability impact confirmed by available data. Organizations that have already completed device adoption and are not actively onboarding new devices face reduced immediate exposure, though the underlying session keys may remain weak until devices are re-adopted under patched firmware.

The CVSS 4.0 base score of 6.9 (Medium) is grounded in an adjacent-network attack vector (AV:A), meaning the attacker must be on the same broadcast domain or network segment as the adopting device or controller - significantly limiting remote opportunistic exploitation. The attack conditions flag (AT:P) further constrains exploitation: the attacker must be positioned to intercept traffic precisely during the adoption phase, adding a timing dependency on top of the network adjacency requirement. User interaction (UI:P) reflects that the adoption process must be actively initiated, typically by an administrator onboarding a new device. Despite these constraints, the confidentiality impact is rated High on both the vulnerable system (VC:H - controller session data) and subsequent systems (SC:H - managed devices whose traffic can now be decrypted), underscoring that successful exploitation yields full visibility into management-plane communications across potentially the entire managed network. No EPSS score was provided in the input data - exploitation probability cannot be quantified from available signals. No KEV listing and no POC availability were indicated, suggesting this is currently a theoretical rather than actively weaponized risk. The primary realistic threat is an insider, a compromised network segment, or a physically proximate attacker targeting the adoption window - not mass automated scanning.

An attacker with access to the network segment hosting an Omada Controller - for example, a rogue device connected to the management VLAN, or a compromised host on the same subnet - captures adoption-phase traffic as an administrator onboards a new access point or switch. The attacker then applies offline cryptanalysis against the captured ciphertext, exploiting the narrow keyspace created by insufficient PRNG entropy to recover the session encryption key. With the recovered key, the attacker decrypts management-plane communications, potentially exposing device credentials, configuration data, or network topology information from both the controller and the managed devices.