CVE-2025-15627: tp link systems inc. omada access points Use of Hard-coded Cryptographic Key
Vulnerability summary
CVE-2025-15627 is a high (CVSS 7.5) Use of Hard-coded Cryptographic Key vulnerability in tp link systems inc. omada access points. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities.
Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.9MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.33 pp
From 0.35% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tp-link112 products
- omada_ds1008x_firmwarena
- omada_ds1016g_firmwarena
- omada_ds1016ge_firmwarena
- omada_ds1018gmp_firmwarena
- omada_ds1024g_firmwarena
Tp-link systems inc.2 products
- omada gatewaysAll versions (No fix recorded)
- omada switchesAll versions (No fix recorded)
Tp link systems inc.1 product
- omada access pointsAll versions (No fix recorded)
Tp-link systems inc1 product
- omada controllersAll versions (No fix recorded)
4 vendors · 116 products
References
3 links- www.tp-link.com/us/support/faq/5216/Vendor Advisory