TP-Link Patches 15 Vulnerabilities in Omada ZTP Mechanism

TP-Link has released patches for 15 vulnerabilities in its Omada network devices' zero-touch provisioning (ZTP) mechanism. Discovered by Forescout's Vedere Labs, these flaws could be exploited to achieve remote code execution (RCE) when chained with previously disclosed vulnerabilities (CVE-2025-7850 and CVE-2025-7851). Affected systems include various TP-Link products such as Wi-Fi access points, switches, and IoT devices. The vulnerabilities involve issues like hard-coded cryptographic keys, device hijacking, and information disclosure. Attackers could exploit predictable serial numbers and default credentials to compromise device configurations. TP-Link has issued security advisories detailing the vulnerabilities and remediation steps. The research was presented at Black Hat USA 2026.

Key Points: • TP-Link patched 15 vulnerabilities in its Omada ZTP mechanism. • Exploitation could lead to remote code execution when combined with existing flaws. • Affected devices include access points, switches, and IoT products.