TP-Link Omada ZTP systems vulnerable to fleet-wide compromise

Fifteen new vulnerabilities were discovered in the zero-touch provisioning (ZTP) systems used by TP-Link’s Omada networking ecosystem, with researchers warning that some flaws can be chained together to compromise entire fleets of managed devices, according to a recent report by Security Week.

The vulnerabilities affect ZTP protocols used for automatic configuration of routers, switches, and access points. Researchers identified issues including hardcoded cryptographic keys, insecure transmission of credentials, weak certificate validation enabling man-in-the-middle attacks, a race condition in cloud-based device adoption, and cross-site scripting flaws. Some flaws, when combined with previously disclosed vulnerabilities, allow external attackers to gain administrative control of cloud controller accounts and internal network access. Attackers on a local network can impersonate controllers or devices to intercept credentials or decrypt traffic. A single compromised controller can manage an entire fleet, potentially leading to root-level command execution on managed devices. While TP-Link has issued patches for some issues, full remediation for structural weaknesses may extend into 2026. The vulnerabilities also extend to other TP-Link product lines, including VIGI, Festa, Tapo, and Kasa.

Source: Security Week