CVE-2025-15627 is a high severity cryptographic weakness in TP-Link Omada switches: hard coded cryptographic keys in the adoption protocol. NVD scores it 7.5. An attacker on the path may impersonate trusted controllers or devices or read adoption traffic. Update controllers and switches to the latest firmware from the Omada download center.
What's affected
The record lists TP-Link Omada switches in the DS1008X, DS1016G, DS1016GE and DS1018GMP families, with their firmware. TP-Link's advisory FAQ, which we fetched, covers this CVE together with CVE-2025-9291, CVE-2025-15544 and CVE-2025-15627 to CVE-2025-15631, and carries the date 08-11-2026. TP-Link rates it 6.9 (medium) on CVSS v4.0. NVD's record lists a different score, so expect the two to differ because they use different CVSS versions. The page we could read did not give a per model fixed version table, so use the Omada download center for the current firmware of your exact model.
How to check if you're exposed
Work from the device inventory in your Omada controller.
-
Open the controller, go to the device list and note each switch model and firmware version.
-
Compare the models with the families above. Anything in those families is in scope.
-
On the Omada download center, find your model and compare the published firmware with what you run.
TP-Link also asks you to keep the controller itself current. The advisory says to update both controllers and managed devices, so check the controller version too.
The CVSS vector in the record (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reports a network attack that needs no account, but TP-Link's own v4.0 vector marks the attack as adjacent network, which means the attacker usually has to be on the same network segment.
What to do now
- List every Omada switch and controller you run and record the firmware version of each.
- Download the latest firmware for each model from the Omada download center, as the TP-Link advisory directs.
- Update the controller and the managed devices, not only one side.
- Until updated, limit who can reach the management and adoption network, and avoid adopting new devices on untrusted segments.
- After the update, review the controller's device list for entries you did not adopt.
Why it matters
The weakness is CWE-321, use of a hard coded cryptographic key. If every device ships with the same key, then anyone who learns that key from one unit, from firmware or from documentation can act as any other. The key stops being a secret and becomes a shared constant.
In an adoption protocol the stakes are trust. Adoption is the moment a controller and a switch decide to trust each other, so weak keys there let an attacker pose as one side to the other. The record says the attacker may impersonate trusted controllers or devices and reach adoption related communications. It is not on the CISA KEV list.
Going further
Network infrastructure updates are often delayed because they need a window. Group the work: controller first, then switches in batches, with a rollback plan. The advisory covers several related CVEs at once, so one maintenance window can close them together.
Where you can, keep the management network separate from user traffic. Many of the attacks in this advisory family need a position on the same network segment, so segmentation limits who can try them.
Quick check
Is a firmware fix available?
TP-Link's advisory recommends updating to the latest firmware from the Omada download center. We did not see a per model version table, so check the download page for your exact switch.
Does this affect switches already adopted?
The weaknesses sit in the adoption protocol, so exposure is highest during adoption. Update anyway, and be careful about when and where you adopt new devices.
Sources
- Safeguard Gold record for CVE-2025-15627
- NVD entry for CVE-2025-15627
- Fetched reference on www.tp-link.com
Last reviewed: 19 October 2026.
