{"id":"CVE-2025-15630","aliases":["EUVD-2025-210612","GHSA-xmx9-537g-pr66"],"status":"published","title":"Device Provisioning Race Condition in TP-Link Omada Adoption Workflow","description":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.","severity":{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00312,"percentile":0.24341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2026-08-03T17:51:06Z","modified":"2026-09-29T14:10:00Z","products":[{"vendor":"tp link systems inc.","product":"omada access points"},{"vendor":"tp-link","product":"omada_ds1008x_firmware"},{"vendor":"tp-link","product":"omada_ds1016g_firmware"},{"vendor":"tp-link","product":"omada_ds1016ge_firmware"},{"vendor":"tp-link","product":"omada_ds1018gmp_firmware"},{"vendor":"tp-link","product":"omada_ds1024g_firmware"},{"vendor":"tp-link","product":"omada_ds105g-m2_firmware"},{"vendor":"tp-link","product":"omada_ds105g_firmware"},{"vendor":"tp-link","product":"omada_ds105ge_firmware"},{"vendor":"tp-link","product":"omada_ds105gp_firmware"},{"vendor":"tp-link","product":"omada_ds105x_firmware"},{"vendor":"tp-link","product":"omada_ds106gpp_firmware"},{"vendor":"tp-link","product":"omada_ds106p_firmware"},{"vendor":"tp-link","product":"omada_ds108g-m2_firmware"},{"vendor":"tp-link","product":"omada_ds108g_firmware"},{"vendor":"tp-link","product":"omada_ds108ge_firmware"},{"vendor":"tp-link","product":"omada_ds108gp_firmware"},{"vendor":"tp-link","product":"omada_ds110gmp_firmware"},{"vendor":"tp-link","product":"omada_ds111p_firmware"},{"vendor":"tp-link","product":"omada_eap610-outdoor_firmware"},{"vendor":"tp-link","product":"omada_eap610_firmware"},{"vendor":"tp-link","product":"omada_eap615-wall_firmware"},{"vendor":"tp-link","product":"omada_eap620hd_firmware"},{"vendor":"tp-link","product":"omada_eap660hd_firmware"},{"vendor":"tp-link","product":"omada_er605_firmware"},{"vendor":"tp-link","product":"omada_er703wp-4g-outdoor_firmware"},{"vendor":"tp-link","product":"omada_er706w-4g_firmware"},{"vendor":"tp-link","product":"omada_er706w_firmware"},{"vendor":"tp-link","product":"omada_er706wp-4g_firmware"},{"vendor":"tp-link","product":"omada_er707-m2_firmware"},{"vendor":"tp-link","product":"omada_er7206_firmware"},{"vendor":"tp-link","product":"omada_er7412-m2_firmware"},{"vendor":"tp-link","product":"omada_er8411_firmware"},{"vendor":"tp-link","product":"omada_es1024ge_firmware"},{"vendor":"tp-link","product":"omada_es205g_firmware"},{"vendor":"tp-link","product":"omada_es205gp_firmware"},{"vendor":"tp-link","product":"omada_es206gp_firmware"},{"vendor":"tp-link","product":"omada_es206x-m2_firmware"},{"vendor":"tp-link","product":"omada_es206xpp-m2_firmware"},{"vendor":"tp-link","product":"omada_es208g_firmware"},{"vendor":"tp-link","product":"omada_es208gp_firmware"},{"vendor":"tp-link","product":"omada_es210gmp_firmware"},{"vendor":"tp-link","product":"omada_es210gp_firmware"},{"vendor":"tp-link","product":"omada_es210x-m2_firmware"},{"vendor":"tp-link","product":"omada_es210xpp-m2_firmware"},{"vendor":"tp-link","product":"omada_es216g_firmware"},{"vendor":"tp-link","product":"omada_es220gmp_firmware"},{"vendor":"tp-link","product":"omada_es220gp_firmware"},{"vendor":"tp-link","product":"omada_es224g_firmware"},{"vendor":"tp-link","product":"omada_es228gmp_firmware"},{"vendor":"tp-link","product":"omada_es228gp_firmware"},{"vendor":"tp-link","product":"omada_fusion_2.5g_firmware"},{"vendor":"tp-link","product":"omada_ies206g_firmware"},{"vendor":"tp-link","product":"omada_ies206gpp_firmware"},{"vendor":"tp-link","product":"omada_ies208g_firmware"},{"vendor":"tp-link","product":"omada_ies210gpp_firmware"},{"vendor":"tp-link","product":"omada_oc200_v3_firmware"},{"vendor":"tp-link","product":"omada_oc300_firmware"},{"vendor":"tp-link","product":"omada_oc400_firmware"},{"vendor":"tp-link","product":"omada_s6500-24g4xf_firmware"},{"vendor":"tp-link","product":"omada_s6500-24gp4xf_firmware"},{"vendor":"tp-link","product":"omada_s6500-24mpp4y_firmware"},{"vendor":"tp-link","product":"omada_s6500-48g6xf_firmware"},{"vendor":"tp-link","product":"omada_s6500-48gp6xf_firmware"},{"vendor":"tp-link","product":"omada_s6500-48mpp6y_firmware"},{"vendor":"tp-link","product":"omada_s7500-24y4c_firmware"},{"vendor":"tp-link","product":"omada_s7500-26xf6y_firmware"},{"vendor":"tp-link","product":"omada_sg2005p-pd_firmware"},{"vendor":"tp-link","product":"omada_sg2008_firmware"},{"vendor":"tp-link","product":"omada_sg2008p_firmware"},{"vendor":"tp-link","product":"omada_sg2016p_firmware"},{"vendor":"tp-link","product":"omada_sg2206mp_firmware"},{"vendor":"tp-link","product":"omada_sg2210mp_firmware"},{"vendor":"tp-link","product":"omada_sg2210p_firmware"},{"vendor":"tp-link","product":"omada_sg2210xmp-m2_firmware"},{"vendor":"tp-link","product":"omada_sg2218_firmware"},{"vendor":"tp-link","product":"omada_sg2218p_firmware"},{"vendor":"tp-link","product":"omada_sg2428lp_firmware"},{"vendor":"tp-link","product":"omada_sg2428p_firmware"},{"vendor":"tp-link","product":"omada_sg2452lp_firmware"},{"vendor":"tp-link","product":"omada_sg3210_firmware"},{"vendor":"tp-link","product":"omada_sg3210x-m2_firmware"},{"vendor":"tp-link","product":"omada_sg3210xhp-m2_firmware"},{"vendor":"tp-link","product":"omada_sg3218xp-m2_firmware"},{"vendor":"tp-link","product":"omada_sg3428_firmware"},{"vendor":"tp-link","product":"omada_sg3428mp_firmware"},{"vendor":"tp-link","product":"omada_sg3428x-m2_firmware"},{"vendor":"tp-link","product":"omada_sg3428x_firmware"},{"vendor":"tp-link","product":"omada_sg3428xf_firmware"},{"vendor":"tp-link","product":"omada_sg3428xmp_firmware"},{"vendor":"tp-link","product":"omada_sg3428xmpp_firmware"},{"vendor":"tp-link","product":"omada_sg3428xpp-m2_firmware"},{"vendor":"tp-link","product":"omada_sg3452_firmware"},{"vendor":"tp-link","product":"omada_sg3452p_firmware"},{"vendor":"tp-link","product":"omada_sg3452xmpp_firmware"},{"vendor":"tp-link","product":"omada_sg3452xp_firmware"},{"vendor":"tp-link","product":"omada_sg5428x_firmware"},{"vendor":"tp-link","product":"omada_sg5428xmpp_firmware"},{"vendor":"tp-link","product":"omada_sg5452x_firmware"},{"vendor":"tp-link","product":"omada_sg5452xmpp_firmware"},{"vendor":"tp-link","product":"omada_sg6428x_firmware"},{"vendor":"tp-link","product":"omada_sg6428xhp_firmware"},{"vendor":"tp-link","product":"omada_sg6654x_firmware"},{"vendor":"tp-link","product":"omada_sg6654xhp_firmware"},{"vendor":"tp-link","product":"omada_sx3008f_firmware"},{"vendor":"tp-link","product":"omada_sx3016f_firmware"},{"vendor":"tp-link","product":"omada_sx3032f_firmware"},{"vendor":"tp-link","product":"omada_sx3206hpp_firmware"},{"vendor":"tp-link","product":"omada_sx3832_firmware"},{"vendor":"tp-link","product":"omada_sx3832mpp_firmware"},{"vendor":"tp-link","product":"omada_sx6632yf_firmware"},{"vendor":"tp-link","product":"omada_tl-sg3210_firmware"},{"vendor":"tp-link","product":"omada_tl-sg3452x_firmware"},{"vendor":"tp-link systems inc","product":"omada controllers"},{"vendor":"tp-link systems inc.","product":"omada access points"},{"vendor":"tp-link systems inc.","product":"omada gateways"},{"vendor":"tp-link systems inc.","product":"omada switches"}],"references":[{"url":"https://www.omadanetworks.com/us/support/download/","tags":["patch","Product"]},{"url":"https://www.omadanetworks.com/en/support/download/","tags":["patch","Product"]},{"url":"https://www.tp-link.com/us/support/faq/5216/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15630"},{"url":"https://www.omadanetworks.com/en/support/download"},{"url":"https://www.omadanetworks.com/us/support/download"},{"url":"https://www.tp-link.com/us/support/faq/5216"},{"url":"https://github.com/advisories/GHSA-xmx9-537g-pr66"}],"sources":{"cve":[{"id":"CVE-2025-15630","title":"Device Provisioning Race Condition in TP-Link Omada Adoption Workflow","description":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.","status":"published","published":"2026-08-03T17:51:06.542Z","modified":"2026-08-03T18:30:42.253Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-210612","description":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.","status":"published","published":"2026-08-03T17:51:06Z","modified":"2026-08-03T18:30:42Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.01774Z"}],"ghsa":[{"id":"GHSA-xmx9-537g-pr66","title":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be...","description":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.","status":"published","published":"2026-08-03T21:31:36Z","modified":"2026-08-07T15:34:06Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:10:11.66732Z"}],"nvd":[{"id":"CVE-2025-15630","description":"A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.","status":"published","published":"2026-08-03T19:16:40.88Z","modified":"2026-09-29T14:10:00.117Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:12:03.20248Z"}]}}