TP-Link Patches 15 Omada ZTP Flaws That Could Enable Network Takeover

TP-Link has released patches for 15 vulnerabilities within the Zero-Touch Provisioning (ZTP) mechanism of its Omada network ecosystem. The flaws, which could allow attackers to compromise entire managed networks, were discovered by Forescout (Vedere Labs) researchers and presented at Black Hat USA 2026.

The vulnerabilities affect a broad spectrum of the Omada lineup, including controllers, gateways, switches, access points, and associated mobile applications. According to Forescout, the flaws can be chained with two previously disclosed vulnerabilities—CVE-2025-7850 and CVE-2025-7851—to achieve remote code execution (RCE). The research team identified several critical security failures, including the use of insecure credentials and hard-coded cryptographic keys.

The Risk of Automated Provisioning

Zero-Touch Provisioning is designed to simplify the deployment of network hardware by allowing devices to be configured automatically and remotely. This removes the need for on-site IT expertise during the initial setup phase. However, because ZTP manages the foundational trust and configuration of new hardware, any vulnerability in this process creates a high-leverage entry point for attackers. If the provisioning phase is intercepted or spoofed, the trust relationship between the controller and the device is broken, potentially granting an attacker administrative control over the hardware before it even enters active service.

Systemic Impact and Exposure

Forescout categorized the impact of these 15 vulnerabilities into four primary areas: client-side code execution, the compromise of encrypted communications, device hijacking or spoofing, and information disclosure. The latter is particularly severe, as it includes the potential leak of passwords and cryptographic keys.

Because Omada deployments are widely utilized across industrial complexes, warehouses, corporate offices, and residential developments, the scale of potential exposure is significant. A compromise at the ZTP level is critical because it targets the very root of device trust. By infiltrating the provisioning phase, an attacker could potentially compromise entire fleets of managed devices, leading to persistent unauthorized access and total infrastructure takeover.

Next Steps for Administrators

Network administrators are urged to apply the latest firmware updates to all affected Omada devices and controllers to mitigate these risks. While TP-Link has addressed the 15 identified flaws, the discovery highlights the inherent risks of relying on hard-coded keys in automated deployment workflows. Organizations should verify that their controllers and gateways are running the patched versions and monitor for any unusual device registration activity that could indicate an attempted ZTP spoofing attack.