Forescout identified 15 new vulnerabilities in TP-Link Omada's ZTP ecosystem, affecting automatic device configuration protocols. Issues include hardcoded cryptographic keys and certificates, insecure transmission of credentials, weak certificate validation enabling man-in-the-middle attacks, a race condition in cloud-based device adoption, and cross-site scripting in controller interfaces. Predictable serial numbers and default credentials facilitate device enumeration and hijacking. Eleven vulnerabilities have CVEs; four were deemed low severity by TP-Link and not assigned CVEs. Attack chains combining these flaws with prior remote code execution vulnerabilities (CVE-2025-7850, CVE-2025-7851) allow attackers to gain administrative cloud controller access and internal network footholds, potentially achieving root command execution on managed devices. TP-Link has patched some issues but expects full remediation of structural problems later in 2026. The vulnerabilities also impact other TP-Link products like VIGI cameras, Festa routers, and Tapo/Kasa smart home devices. Despite recommendations, many Omada controllers remain internet-exposed, increasing exploitation risk.

Successful exploitation of these vulnerabilities can allow attackers to gain administrative control over TP-Link Omada cloud controllers and internal networks, potentially leading to root-level command execution on managed devices. Attackers can intercept credentials, decrypt traffic, impersonate devices or controllers, and hijack device fleets. The vulnerabilities affect network security and device integrity across multiple TP-Link product lines. Exposure of Omada controllers to the internet significantly increases the risk of remote compromise.

TP-Link has released patches and advisories addressing some of the reported vulnerabilities. Remediation for structural weaknesses is expected to continue through 2026, while some low-severity issues will not be patched. Network administrators should apply available patches promptly. Omada controllers should not be exposed to the internet to reduce attack surface. Monitor vendor advisories for updates on ongoing remediation efforts and implement recommended configuration changes to mitigate risks.