CVE-2025-15628 is a high severity cryptographic weakness in TP-Link Omada switches: hard coded certificates in the adoption protocol. NVD scores it 7.5. An attacker on the path may impersonate trusted controllers or devices or read adoption traffic. Update controllers and switches to the latest firmware from the Omada download center.
What's affected
The record lists TP-Link Omada switches in the DS1008X, DS1016G, DS1016GE and DS1018GMP families, with their firmware. TP-Link's advisory FAQ, which we fetched, covers this CVE together with CVE-2025-9291, CVE-2025-15544 and CVE-2025-15627 to CVE-2025-15631, and carries the date 08-11-2026. TP-Link rates it 8.2 (high) on CVSS v4.0. NVD's record lists a different score, so expect the two to differ because they use different CVSS versions. The page we could read did not give a per model fixed version table, so use the Omada download center for the current firmware of your exact model.
How to check if you're exposed
Work from the device inventory in your Omada controller.
-
Open the controller, go to the device list and note each switch model and firmware version.
-
Compare the models with the families above. Anything in those families is in scope.
-
On the Omada download center, find your model and compare the published firmware with what you run.
TP-Link also asks you to keep the controller itself current. The advisory says to update both controllers and managed devices, so check the controller version too.
The CVSS vector in the record (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reports a network attack that needs no account, but TP-Link's own v4.0 vector marks the attack as adjacent network, which means the attacker usually has to be on the same network segment.
What to do now
- List every Omada switch and controller you run and record the firmware version of each.
- Download the latest firmware for each model from the Omada download center, as the TP-Link advisory directs.
- Update the controller and the managed devices, not only one side.
- Until updated, limit who can reach the management and adoption network, and avoid adopting new devices on untrusted segments.
- After the update, review the controller's device list for entries you did not adopt.
Why it matters
The weakness is CWE-798, use of hard coded credentials. Embedded certificates that are shared across deployments mean that one extracted copy works against many sites. Certificates are meant to prove identity, and a shared one proves nothing about which device is on the line.
The record says an attacker who obtains the embedded certificates may impersonate trusted controllers or devices and intercept affected communications. TP-Link's advisory rates this one higher than its siblings. It is not on the CISA KEV list.
Going further
Network infrastructure updates are often delayed because they need a window. Group the work: controller first, then switches in batches, with a rollback plan. The advisory covers several related CVEs at once, so one maintenance window can close them together.
Where you can, keep the management network separate from user traffic. Many of the attacks in this advisory family need a position on the same network segment, so segmentation limits who can try them.
Cryptographic weaknesses like this are harder to see than a crash or a bad page. Nothing fails visibly. The way to catch them is inventory and process: know which firmware each device runs, and treat vendor advisories as work items with an owner and a date.
The advisory's wording about scores is a useful reminder. Vendors using CVSS v4.0 and NVD records using v3.1 can show different numbers for one flaw. Do not treat either as final. Use them to rank work, then read the description to decide what it means for your network.
For software you build, the free in-browser scan at https://gold.safeguard.sh/scan covers known vulnerable libraries. Firmware for switches is outside that scope, so keep the steps above as the routine for network devices.
Quick check
Is a firmware fix available?
TP-Link's advisory recommends updating to the latest firmware from the Omada download center. We did not see a per model version table, so check the download page for your exact switch.
Does this affect switches already adopted?
The weaknesses sit in the adoption protocol, so exposure is highest during adoption. Update anyway, and be careful about when and where you adopt new devices.
Sources
- Safeguard Gold record for CVE-2025-15628
- NVD entry for CVE-2025-15628
- Fetched reference on www.tp-link.com
Last reviewed: 19 October 2026.
