CyberSecBulletin
CVE-2025-15627NVD status: Analyzed

Omada Gateways: Use of Hard-coded Cryptographic Key

Published Updated By the CyberSecBulletin desk

CVE-2025-15627 is a high-severity use of hard-coded cryptographic key vulnerability in Omada Gateways from TP-Link, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Omada Gateways versions: 0. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.68% chance of exploitation within 30 days, higher than 53% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of Omada Gateways you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on tp-link.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
TP-LinkOmada Gateways0Not stated
TP-LinkOmada Switches0Not stated
TP-LinkOmada Access Points0Not stated
TP-LinkOmada Controllers0Not stated
TP-LinkOmada Oc200 V3 FirmwareNot specified in the recordNot stated
TP-LinkOmada Oc300 FirmwareNot specified in the recordNot stated
TP-LinkOmada Oc400 FirmwareNot specified in the recordNot stated
TP-LinkOmada Fusion 2.5g FirmwareNot specified in the recordNot stated
TP-LinkOmada Er707-m2 FirmwareNot specified in the recordNot stated
TP-LinkOmada Tl-sg3452x FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3428xmpp FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3428xmp FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3428x FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2005p-pd FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3452p FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3452 FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3428mp FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3428 FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg3210 FirmwareNot specified in the recordNot stated
TP-LinkOmada Tl-sg3210 FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2452lp FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2428p FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2428lp FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2218p FirmwareNot specified in the recordNot stated
TP-LinkOmada Sg2218 FirmwareNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.06.9MediumCNA
CVSS 3.17.5HighNVD

Official description

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Hard-coded Cryptographic Key

The product uses a hard-coded, unchangeable cryptographic key.

How developers prevent this class of flaw

  • Prevention schemes mirror that of hard-coded password storage.

More Use of Hard-coded Cryptographic Key vulnerabilities (CWE-321)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Omada Gateways

All Omada Gateways vulnerabilities

Recent Use of Hard-coded Cryptographic Key vulnerabilities

Spotted an error? Tell us.