TP-Link Patches 15 Omada ZTP Flaws After Black Hat Disclosure

Black Hat USA. August 4, 2026. Forescout Vedere Labs dropped 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of TP-Link’s Omada product line during their briefing. Eleven received CVE identifiers. When chained with two previously disclosed flaws — CVE-2025-7850 and CVE-2025-7851 — they allow a remote attacker to break Omada’s chain of trust, achieve remote code execution, and pivot into the organization’s internal network. The fix shipped on August 4, 2026 at 6:18 PM ET. If you deployed Omada access points, switches, or routers via ZTP, the clock is ticking — attackers will weaponize these within days.

ZTP: the convenience that became an attack surface

Omada is TP-Link’s business-grade networking line. It covers Wi-Fi access points, Ethernet and PoE switches, Internet gateways, and VPN routers. The pitch is straightforward — SMBs and multi-site deployments get enterprise features without enterprise complexity, anchored by a single promise: zero-touch provisioning means you never have to touch a device after unboxing it.

The workflow is elegant. A technician plugs the hardware in at the remote site. The device announces itself to the Omada controller — cloud-hosted or on-prem. The controller recognizes it, pushes its configuration, activates licenses. Minutes later, the site is live. This is exactly what MSPs and lean IT teams want: fewer truck rolls, standardized deployments, automated fleet management.

The problem, documented by Forescout Vedere Labs in a report released alongside Black Hat USA 2026, is that the automation rests on a trust chain the researchers dismantled across four impact categories.

Four categories, fifteen flaws

Forescout structured its findings around four concrete impacts:

• Client-side code execution. An attacker can inject JavaScript into the Omada controller’s admin interface. The code runs in the legitimate administrator’s browser — session theft, token exfiltration, lateral movement to adjacent systems.
• Information disclosure. The ZTP adoption process leaks cleartext usernames, unsalted MD5 password hashes, and potentially VPN keys. Enough to pivot into whatever infrastructure those devices are supposed to protect.
• Device hijacking and spoofing. Predictable serial numbers and the absence of strong authentication during adoption let an attacker impersonate a legitimate device and receive its full configuration — secrets included.
• Compromise of encrypted communications. Hard-coded cryptographic keys and shared certificates across devices break the TLS trust model within the Omada network.

The 11 assigned CVEs range from CVE-2025-9289 through CVE-2025-9293, plus CVE-2025-15544 and CVE-2025-15627 through CVE-2025-15631. Four additional findings, deemed less critical on paper but equally exploitable in practice, went unnumbered: adoption based solely on knowing the serial number, default credentials during initial adoption, predictable serial number sequences, and files served via unauthenticated temporary download links.

Attack chain: from serial number to RCE

Forescout’s most complete attack scenario is a five-step chain, fully automatable:

1. Enumeration. The attacker scans Omada serial number ranges — their predictable structure allows generating valid identifiers without ever touching the target.
2. MAC mapping. Each serial number maps to a MAC address. The attacker obtains MAC addresses and identifies devices awaiting adoption — the ones just plugged in at a new site.
3. Impersonation. The attacker poses as one of those devices to the controller, exploits a race condition in cloud adoption, and authenticates with default credentials — the very ones ZTP is supposed to replace, but which remain active during the adoption window.
4. Exfiltration. The controller, believing it’s talking to a legitimate device, sends the full configuration: cleartext username, unsalted MD5 password hash (trivial to crack), and potentially the site’s VPN keys.
5. Pivot. With these secrets, the attacker establishes VPN access to the internal network. If CVE-2025-7850 and CVE-2025-7851 — two command injection flaws in the admin interface — are present, escalation to RCE on the controller itself follows.

No one ever set foot in the building. No phishing email was ever sent.

TP-Link’s response

TP-Link released patches on August 4, 2026, coordinated with the Black Hat briefing. The security advisory lists all 15 flaws, the 11 CVEs, and the fixed Omada firmware versions. Forescout described the coordination as professional — the fix was ready before public disclosure.

But the software update alone isn’t enough. Equipment deployed via ZTP and adopted before the patch may still hold compromised configurations. Forescout explicitly recommends resetting and re-adopting devices after updating, and rotating every secret — passwords, VPN keys, API tokens — that ever transited through the Omada controller.

The CISA added the most critical CVEs to its Known Exploited Vulnerabilities catalog on August 5. The NCSC issued a concurrent advisory for UK organizations using Omada in government-adjacent deployments.

Verdict

If you manage an Omada fleet deployed via ZTP, three actions, now:

1. Update the firmware on the Omada controller and all managed devices to the August 4, 2026 release.
2. Reset and re-adopt devices that were provisioned before the patch. A firmware update alone won’t help if secrets have already leaked.
3. Audit your ZTP process. If serial numbers are your sole adoption factor, add out-of-band authentication: manual approval, MAC allowlisting, or client certificates.

For deployments under 20 devices, manual adoption without ZTP is slower but eliminates the attack surface entirely. For fleets above 50 devices, ZTP is non-negotiable — but it must be paired with strong authentication. SMBs that turned on ZTP “because it was the default” are the primary target for attackers who will operationalize these flaws in the coming days.

References

• Forescout Vedere Labs — TP-Link Omada ZTP Research
• TP-Link Security Advisory — Omada ZTP
• BleepingComputer — TP-Link patches Omada ZTP flaws
• CISA KEV Catalog
• NVD — CVE-2025-7850