Description
A race
condition exists in the cloud-based Omada device adoption process when an
attacker may be able to interact with the adoption workflow before a legitimate
device completes registration, resulting in provisioning information being
delivered to an attacker.









Successful
exploitation may allow disclosure of provisioning information intended for a
legitimate device.
Published: 2026-08-03
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link omada Access Point
Tp-link omada Controller
Tp-link omada Gateways
Tp-link omada Switches
Vendors & Products Tp-link
Tp-link omada Access Point
Tp-link omada Controller
Tp-link omada Gateways
Tp-link omada Switches

Wed, 05 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 03 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.
Title Device Provisioning Race Condition in TP-Link Omada Adoption Workflow
Weaknesses CWE-362
References
Metrics cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}


Subscriptions

Tp-link Omada Access Point Omada Controller Omada Gateways Omada Switches
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-08-03T18:30:42.253Z

Reserved: 2026-04-10T16:33:55.447Z

Link: CVE-2025-15630

cve-icon Vulnrichment

Updated: 2026-08-03T18:30:38.824Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-03T19:16:40.880

Modified: 2026-08-07T15:13:46.860

Link: CVE-2025-15630

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:21:45Z

Weaknesses