Critical Vulnerabilities Exposed in TP-Link Omada Zero-Touch Provisioning

Researchers at Forescout Research - Vedere Labs have discovered fifteen previously unknown vulnerabilities affecting the zero-touch provisioning process in TP-Link Omada networking equipment. The findings were detailed at the Black Hat USA conference in Las VegasStanislav Dashevskyi, principal security researcher, and Francesco La Spina, senior security researcher at Forescout Research - Vedere Labs, reported that the flaws impact centralized network provisioning systems used by small and medium-sized enterprises, industrial facilities, warehouses, and residential deployments to rapidly configure routers and firewalls. The newly identified vulnerabilities are categorized into four distinct areas: client-side code execution through cross-channel scripting, the disclosure of sensitive credentials including passwords and cryptographic keys, device hijacking and spoofing, and the compromise of encrypted communications alongside the underlying chain of trust. According to the research team, malicious actors could chain these newly uncovered flaws together with previously disclosed command-injection vulnerabilities, tracked as CVE-2025-7850 and CVE-2025-7851, which permit root shell access to the operating system. These combined exploits can provide attackers with initial network access and facilitate lateral movement across connected systems. Investigators noted that Omada provisioning and management protocols can be weaponized to bypass conventional security perimeters. During internet-wide scans, researchers located approximately 1,800 Omada controllers directly exposed to the open internet, contrary to standard deployment guidelines. Beyond core routers and firewalls, the vulnerabilities also affect associated hardware components, including IP cameras, Internet of Things