CVE-2025-15627 describes a vulnerability in TP-Link Systems Inc. Omada Gateways where the adoption protocol uses hard-coded cryptographic keys (CWE-321). This cryptographic weakness compromises the authentication exchanges between controllers and managed devices during the adoption process. An attacker exploiting this flaw may impersonate trusted entities to intercept or manipulate sensitive adoption-related communications. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is provided, and the product is not a cloud service.

The use of hard-coded cryptographic keys weakens the security of the adoption protocol, potentially allowing attackers to impersonate trusted controllers or managed devices. This could lead to unauthorized access to sensitive communications related to device adoption, undermining the integrity and confidentiality of the network management process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor TP-Link's advisories for updates. Until a fix is available, consider limiting network exposure of Omada Gateways and adopting compensating controls where possible.