EUVD-2025-210612
GHSA-xmx9-537g-pr66
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack vector with high complexity for race timing; PR:L for cloud workflow access; UI:R because a legitimate device must concurrently trigger adoption; no availability impact described.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.
Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.
AnalysisAI
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Technical ContextAI
The TP-Link Omada platform manages network devices (gateways, switches, access points, and controllers) through a cloud-hosted adoption workflow. During adoption, a device contacts the cloud controller and receives provisioning credentials or configuration. The race condition (CWE-362) arises because the adoption service does not atomically bind a device's identity claim to its provisioning payload before delivering it - an attacker who can participate in the adoption workflow concurrently with a legitimate device can win the timing window and receive the provisioning data. The CPE strings (cpe:2.3:a:tp-link_systems_inc.:omada_gateways:*:*:*:*:*:*:*:*, cpe:2.3:a:tp-link_systems_inc.:omada_switches:*:*:*:*:*:*:*:*, cpe:2.3:a:tp_link_systems_inc.:omada_access_points:*:*:*:*:*:*:*:*, cpe:2.3:a:tp-link_systems_inc:omada_controllers:*:*:*:*:*:*:*:*) indicate all current Omada product lines are affected with no version floor specified, suggesting a broad-scope flaw in shared cloud infrastructure rather than a firmware-specific defect.
RemediationAI
TP-Link has released a patch and it is available from the vendor download portal at https://www.omadanetworks.com/us/support/download/ and https://www.omadanetworks.com/en/support/download/. The advisory at https://www.tp-link.com/us/support/faq/5216/ should be consulted for specific patched version numbers, as no exact fix version was provided in the available intelligence. Because the flaw is in the cloud-based adoption workflow rather than device firmware alone, customers should ensure their Omada controllers are updated promptly and verify that the cloud adoption service reflects the patched behavior. As a compensating control, administrators can perform device adoption on isolated network segments where unauthorized devices cannot interact with the adoption workflow, reducing the attacker's ability to race the timing window. Switching to local controller adoption (bypassing cloud-based registration entirely) where operationally feasible eliminates the cloud-race-condition surface entirely, though this may reduce management convenience for distributed deployments.
More in Omada Gateways
View allShared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and manage
Improper certificate hostname validation in TP-Link Omada networking devices (gateways, switches, and access points) all
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate tru
Credential interception in TP-Link Omada's device adoption process exposes site management authentication to offline cra
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-t
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today