CVE-2025-15628: tp link systems inc. omada access points Use of Hard-coded Credentials
Vulnerability summary
CVE-2025-15628 is a high (CVSS 8.2) Use of Hard-coded Credentials vulnerability in tp link systems inc. omada access points. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.7% of scored vulnerabilities.
Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.2HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
+0.10 pp
From 0.22% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tp-link112 products
- omada_ds1008x_firmwarena
- omada_ds1016g_firmwarena
- omada_ds1016ge_firmwarena
- omada_ds1018gmp_firmwarena
- omada_ds1024g_firmwarena
Tp-link systems inc.3 products
- omada gatewaysAll versions (No fix recorded)
- omada oltsAll versions (No fix recorded)
- omada switchesAll versions (No fix recorded)
Tp link systems inc.1 product
- omada access pointsAll versions (No fix recorded)
Tp-link systems inc1 product
- omada controllersAll versions (No fix recorded)
4 vendors · 117 products
References
3 links- www.tp-link.com/us/support/faq/5216/Vendor Advisory