High severity · published Aug 3, 2026
CVE-2025-15627
Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
Omada Ds1008x Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds1016g Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds1016ge Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds1024g Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds105g Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds105g-m2 Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds105ge Firmware · Tp-link
All versions, or not specified · source: NVD
OD
Omada Ds105x Firmware · Tp-link
All versions, or not specified · source: NVD
Affected product
OA
Omada Access Points
TP Link Systems Inc.
More from Omada Access Points
7.5
CVE-2025-15629
Weak Session Key Generation in TP-Link Omada Adoption Protocol
7.5
CVE-2025-15628
Hardcoded Certificates in TP-Link Omada Device Communications
6.5
CVE-2025-9291
Improper Certificate Validation in TP-Link Omada Cloud Communications
5.9
CVE-2025-15631
Weak Credential Storage in TP-Link Omada Devices
5.9
CVE-2025-15630
Device Provisioning Race Condition in TP-Link Omada Adoption Workflow