TP-Link patches 15 Omada provisioning flaws that chain into network takeover

TP-Link patched 15 vulnerabilities in the zero-touch provisioning system of its Omada business networking line, which lets IT teams and managed service providers configure switches, access points, gateways, and routers remotely. Forescout's Vedere Labs, which presented the findings at Black Hat, reported hardcoded cryptographic keys and certificates, insecure credential transmission, weak certificate validation enabling interception, a race condition in cloud device adoption, and default credentials. Chained with two previously disclosed command-injection flaws, they let an attacker break the provisioning chain of trust and infiltrate networks. Eleven received CVEs, and some issues also affect TP-Link cameras and smart-home devices. Forescout found over 1,800 exposed controllers.

Check

Apply TP-Link's Omada firmware and controller updates, take controller management interfaces off the public internet, and change any default device credentials still in use.

Affected

Organizations, and the managed service providers serving them, running TP-Link Omada devices; the provisioning flaws enable interception, device hijacking, and, chained with prior command-injection bugs, remote code execution and network infiltration.

Fix

Update affected Omada controllers and devices, restrict controller exposure, replace default credentials and certificates, monitor for rogue device adoption, and extend checks to affected TP-Link cameras and smart-home products.