Vulnerability · Published Aug 3, 2026 · Assigned by TPLink
CVE-2025-15630Device Provisioning Race Condition in TP-Link Omada Adoption Workflow
Medium 5.8
In plain English
A medium-severity race condition in Omada Access Points from TP Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Omada Gateways | 0 |
| TP-Link Systems Inc. | Omada Switches | 0 |
| TP Link Systems Inc. | Omada Access Points | 0 |
| TP-Link Systems Inc | Omada Controllers | 0 |
Weakness: CWE-362 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N