Every CVE Search/ Get API key

CVE-2025-15630

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

5.8 Medium

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.31%Up 0.1 points since Aug 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Record
CVE-2025-15630
CVSS 4.0
5.8 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2025-210612 5.8

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Record
EUVD-2025-210612
CVSS 4.0
5.8 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xmx9-537g-pr66 5.8

A race condition exists in the cloud-based Omada device adoption process when an attacker may be...

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Record
GHSA-xmx9-537g-pr66
CVSS 4.0
5.8 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
NVD 5.8

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Record
CVE-2025-15630
CVSS 4.0
5.8 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02

Affected products

Show 105 moreShow less

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-15630 is a medium vulnerability (CVSS 5.8) in Tp Link Systems Inc. Omada Access Points, published August 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open