CVE-2025-15629: tp link systems inc. omada access points Insufficient Entropy

Vulnerability summary

CVE-2025-15629 is a high (CVSS 7.5) Insufficient Entropy vulnerability in tp link systems inc. omada access points. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.2% of scored vulnerabilities.

Timeline

1. 03-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

• CWE-331Insufficient EntropyThe product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.