CVE-2025-15627

Analyzed Analyzed - Analysis Complete

Hard-Coded Cryptographic Keys in Omada Adoption Protocol

Publication date: 2026-08-03

Last updated on: 2026-08-07

Assigner: TPLink

Description

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-07

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2025-15627

EUVD

EUVD-2025-210609

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	omada_oc200_v3_firmware	*
tp-link	omada_oc300_firmware	*
tp-link	omada_oc400_firmware	*
tp-link	omada_fusion_2.5g_firmware	*
tp-link	omada_er707-m2_firmware	*
tp-link	omada_tl-sg3452x_firmware	*
tp-link	omada_sg3428xmpp_firmware	*
tp-link	omada_sg3428xmp_firmware	*
tp-link	omada_sg3428x_firmware	*
tp-link	omada_sg2005p-pd_firmware	*
tp-link	omada_sg3452p_firmware	*
tp-link	omada_sg3452_firmware	*
tp-link	omada_sg3428mp_firmware	*
tp-link	omada_sg3428_firmware	*
tp-link	omada_sg3210_firmware	*
tp-link	omada_tl-sg3210_firmware	*
tp-link	omada_sg2452lp_firmware	*
tp-link	omada_sg2428p_firmware	*
tp-link	omada_sg2428lp_firmware	*
tp-link	omada_sg2218p_firmware	*
tp-link	omada_sg2218_firmware	*
tp-link	omada_sg2016p_firmware	*
tp-link	omada_sg2210mp_firmware	*
tp-link	omada_sg2210p_firmware	*
tp-link	omada_sg2008p_firmware	*
tp-link	omada_sg2008_firmware	*
tp-link	omada_sg2206mp_firmware	*
tp-link	omada_es210xpp-m2_firmware	*
tp-link	omada_es210x-m2_firmware	*
tp-link	omada_es206xpp-m2_firmware	*
tp-link	omada_es206x-m2_firmware	*
tp-link	omada_es228gmp_firmware	*
tp-link	omada_es228gp_firmware	*
tp-link	omada_es224g_firmware	*
tp-link	omada_es220gp_firmware	*
tp-link	omada_es216g_firmware	*
tp-link	omada_es210gmp_firmware	*
tp-link	omada_es210gp_firmware	*
tp-link	omada_es208gp_firmware	*
tp-link	omada_es208g_firmware	*
tp-link	omada_es206gp_firmware	*
tp-link	omada_es205gp_firmware	*
tp-link	omada_es205g_firmware	*
tp-link	omada_es220gmp_firmware	*
tp-link	omada_es1024ge_firmware	*
tp-link	omada_ds1016ge_firmware	*
tp-link	omada_ds108ge_firmware	*
tp-link	omada_ds105ge_firmware	*
tp-link	omada_ds1008x_firmware	*
tp-link	omada_ds105x_firmware	*
tp-link	omada_ds108g-m2_firmware	*
tp-link	omada_ds105g-m2_firmware	*
tp-link	omada_ds1024g_firmware	*
tp-link	omada_ds1016g_firmware	*
tp-link	omada_ds110gmp_firmware	*
tp-link	omada_ds108g_firmware	*
tp-link	omada_ds106gpp_firmware	*
tp-link	omada_ds106p_firmware	*
tp-link	omada_ds105g_firmware	*
tp-link	omada_ds111p_firmware	*
tp-link	omada_ds1018gmp_firmware	*
tp-link	omada_ds108gp_firmware	*
tp-link	omada_ds105gp_firmware	*
tp-link	omada_ies210gpp_firmware	*
tp-link	omada_ies206gpp_firmware	*
tp-link	omada_ies208g_firmware	*
tp-link	omada_ies206g_firmware	*
tp-link	omada_eap660hd_firmware	*
tp-link	omada_eap620hd_firmware	*
tp-link	omada_eap610_firmware	*
tp-link	omada_eap615-wall_firmware	*
tp-link	omada_eap610-outdoor_firmware	*
tp-link	omada_er7206_firmware	*
tp-link	omada_er706w_firmware	*
tp-link	omada_er8411_firmware	*
tp-link	omada_er605_firmware	*
tp-link	omada_er7412-m2_firmware	*
tp-link	omada_er706w-4g_firmware	*
tp-link	omada_er703wp-4g-outdoor_firmware	*
tp-link	omada_er706wp-4g_firmware	*
tp-link	omada_s7500-24y4c_firmware	*
tp-link	omada_s7500-26xf6y_firmware	*
tp-link	omada_s6500-48mpp6y_firmware	*
tp-link	omada_s6500-24mpp4y_firmware	*
tp-link	omada_s6500-48gp6xf_firmware	*
tp-link	omada_s6500-48g6xf_firmware	*
tp-link	omada_s6500-24gp4xf_firmware	*
tp-link	omada_s6500-24g4xf_firmware	*
tp-link	omada_sx6632yf_firmware	*
tp-link	omada_sx3032f_firmware	*
tp-link	omada_sx3016f_firmware	*
tp-link	omada_sx3008f_firmware	*
tp-link	omada_sg3428xf_firmware	*
tp-link	omada_sx3832mpp_firmware	*
tp-link	omada_sx3832_firmware	*
tp-link	omada_sx3206hpp_firmware	*
tp-link	omada_sg3428xpp-m2_firmware	*
tp-link	omada_sg3428x-m2_firmware	*
tp-link	omada_sg3218xp-m2_firmware	*
tp-link	omada_sg3210xhp-m2_firmware	*
tp-link	omada_sg3210x-m2_firmware	*
tp-link	omada_sg2210xmp-m2_firmware	*
tp-link	omada_sg6654xhp_firmware	*
tp-link	omada_sg6654x_firmware	*
tp-link	omada_sg6428xhp_firmware	*
tp-link	omada_sg6428x_firmware	*
tp-link	omada_sg5452xmpp_firmware	*
tp-link	omada_sg5452x_firmware	*
tp-link	omada_sg5428xmpp_firmware	*
tp-link	omada_sg5428x_firmware	*
tp-link	omada_sg3452xmpp_firmware	*
tp-link	omada_sg3452xp_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability is a cryptographic weakness in the Omada adoption protocol. It uses hard-coded cryptographic keys to establish trust between controllers and managed devices during device adoption. Attackers can exploit this to impersonate trusted controllers or devices and gain access to sensitive adoption communications.

Detection Guidance

This vulnerability involves weak cryptographic keys in the Omada adoption protocol. Detection requires inspecting network traffic for hard-coded keys or unusual adoption exchanges. Use packet capture tools like tcpdump or Wireshark to analyze Omada protocol traffic between controllers and devices. Look for repeated or predictable key exchanges.

Impact Analysis

An attacker could intercept or manipulate adoption-related communications, potentially gaining unauthorized access to your network or sensitive data. This could lead to unauthorized device control or exposure of confidential information.

Compliance Impact

This vulnerability may violate compliance requirements for data protection and network security, such as GDPR or HIPAA, by enabling unauthorized access to sensitive communications. Organizations could face penalties for failing to protect data integrity and confidentiality.

Mitigation Strategies

Immediately update Omada controller and managed devices to the latest patched versions to remove hard-coded cryptographic keys and enforce secure adoption protocols.

Hi! I’m here to help you understand CVE-2025-15627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70