CVE-2025-15629

CVE-2025-15629 affects the TP-Link Omada Oc200 controller and likely other devices running the same firmware logic. The vulnerability is not a typical session hijacking issue—it is a failure in the adoption protocol itself, which is the trust establishment ceremony when a device first joins a controller. During this critical phase, session keys are generated with insufficient entropy, making them predictable. This is what makes the CVSS 7.5 rating misleading. The real risk is that an attacker who intercepts traffic during adoption can recover the session keys and, crucially, derive the cryptographic credentials used for device identity. This means the attacker can impersonate either the controller or the adopted device indefinitely—not just intercept current traffic. The attack does not require active man-in-the-middle during every session; it requires interception during one adoption event, after which the attacker holds credentials that remain valid. The adoption protocol operates before full device provisioning, which means a successful key recovery could allow injection of malicious firmware updates or configuration changes that persist beyond a simple firmware patch. If the insufficient entropy stems from predictable seeding sources in the boot sequence, then every device of this model class may share the same vulnerability—new devices shipping with the same firmware logic will be affected until the fix propagates through the supply chain. The physical proximity requirement is deceptively restrictive. In target environments—campus networks, industrial facilities, managed service infrastructure—adoption windows are often structurally predictable. Devices boot in known sequences, maintenance windows are scheduled, and the attack surface concentrates around these ceremonies. A firmware patch fixes future adoption ceremonies. It does not fix devices that have already completed adoption with predictable keys. Those devices remain compromised until they re-adopt with patched firmware—a procedure that itself reopens the vulnerability window. Legacy devices in the field will be vulnerable on every future adoption (factory resets, controller migrations, hardware replacement) unless the firmware is explicitly updated. Treat this as a credential compromise, not just a cryptographic flaw: the fix requires both patching and re-establishing trust for existing deployments.

Reviewed through automated stages and approved by a human before publication.