BleepingComputer

Dark Reading

Hacker News

Forescout’s Vedere Labs dropped 15 new vulnerabilities in TP-Link’s Omada networking ecosystem at Black Hat USA 2026, and the attack chain they demonstrated is genuinely ugly.
The short version: an external attacker can enumerate predictable sequential serial numbers, exploit a race condition during cloud device adoption, impersonate a legitimate device, authenticate with default credentials, pull cleartext secrets and VPN keys, inject JavaScript into admin interfaces, and walk out with full network access. No physical access required. The researchers chained these 15 bugs with two previously known command-injection CVEs (CVE-2025-7850 and CVE-2025-7851) to get there.
The deeper point Forescout is making isn’t just “patch your TP-Link gear” — it’s that zero-touch provisioning as a category has a structural problem. ZTP collapses a huge number of trust decisions into a single automated flow. That’s the whole appeal. It’s also why it’s such a high-value target. When the onboarding process itself is compromised, you don’t need to fight your way through the network — you’re handed the keys during setup.
The specific weaknesses here span hard-coded cryptographic keys, encryption trust failures, device spoofing, and credential disclosure. The blast radius isn’t limited to Omada either — Forescout flags that similar risks exist across TP-Link’s Festa, VIGI, Tapo, and Kasa ecosystems.
Over 1,800 Omada controllers are currently internet-accessible, which is the number that should make enterprise network teams uncomfortable.
TP-Link has patched the flaws. The practical checklist: update firmware now, replace default credentials everywhere, enable MFA, rotate any secrets that touched affected systems, and segment provisioning infrastructure from the rest of your network. Forescout’s broader recommendation is to treat ZTP as “Zero-Trust Provisioning” — meaning threat-model it like any other high-privilege automated system, not assume the convenience is free.

Trends

Forescout's Vedere Labs disclosed 15 previously unknown vulnerabilities in TP-Link's Omada Zero-Touch Provisioning (ZTP) system at Black Hat USA. The flaws include hard-coded cryptographic keys, predictable serial numbers, device spoofing, race conditions, cleartext credential theft, VPN key exposure, and JavaScript injection. When chained with two known command-injection CVEs, attackers can impersonate devices during provisioning, steal credentials, and fully compromise the network controller. Over 1,800 Omada controllers are currently internet-exposed. TP-Link has issued patches; recommended mitigations include firmware updates, credential rotation, MFA, network segmentation, and Zero Trust principles for device onboarding. Similar risks may exist across TP-Link's Festa, VIGI, Tapo, and Kasa ecosystems.

TP-Link's Omada ZTP had 15 flaws that could hand attackers your whole network