CVE-2025-15630 Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

Medium 5.8 Published 3 Aug 2026 Updated 3 Aug 2026

An attacker can exploit a race condition during device adoption to intercept provisioning information intended for legitimate network devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-15630?

CVE-2025-15630 is a medium-severity vulnerability in TP Link Systems Inc. Omada Access Points, published on 3 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker.

Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

Weakness: CWE-362

Which versions are affected by CVE-2025-15630?

It affects 112 products.

Products include Tp-Link Omada Ds1008x Firmware, Tp-Link Omada Ds1016g Firmware, Tp-Link Omada Ds1016ge Firmware, Tp-Link Omada Ds1018gmp Firmware, Tp-Link Omada Ds1024g Firmware, Tp-Link Omada Ds105g-M2 Firmware and 106 more.

How do I fix CVE-2025-15630?

No fix has been published for CVE-2025-15630 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-15630 being exploited?

There is no known exploitation of CVE-2025-15630 in the wild and no public exploit code.

Sources

Also known as GHSA-xmx9-537g-pr66.