Is CVE-2025-15627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15627 being exploited in the wild.

How severe is CVE-2025-15627?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Which products and versions are affected?

TP-Link Deco BE85; TP-Link Deco BE65; TP-Link Deco BE65 Pro; TP-Link Deco BE25; and 2 more.

Is there a fix for CVE-2025-15627?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15627 attacked?

It is attacked over the network.

Am I affected by CVE-2025-15627?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15627: TP-Link Omada adoption protocol cryptographic key weakness

CVE-2025-15627 · Severity: high · CVSS 7.5 · Published 2026-08-03

TP-Link Omada is a network management platform used to configure and oversee WiFi mesh systems and enterprise networking devices. The adoption protocol—which establishes initial trust between controllers and managed devices—relies on hard-coded cryptographic keys that are identical across all deployments. An attacker with network access can exploit this weakness to impersonate legitimate controllers or devices, potentially gaining unauthorized access to device configuration and sensitive network communications during the adoption phase.

Quick answers

Is CVE-2025-15627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15627 being exploited in the wild.
How severe is CVE-2025-15627?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: TP-Link Deco BE85; TP-Link Deco BE65; TP-Link Deco BE65 Pro; TP-Link Deco BE25; and 2 more.
Is there a fix for CVE-2025-15627?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15627 attacked?: It is attacked over the network.
Am I affected by CVE-2025-15627?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Omada adoption protocol's use of hard-coded cryptographic keys to establish trust between controllers and managed devices. Rather than using unique or dynamically negotiated keys, the protocol employs static, shared secrets that are compiled into the software. This allows an attacker with network access to intercept and decrypt adoption-related communications or forge authentication exchanges without legitimate credentials. The attack requires network-level access to the adoption traffic but no authentication to the victim devices. An attacker can impersonate trusted controllers or devices to alter configuration, inject malicious settings, or extract sensitive information during device onboarding.

Affected products

TP-Link Deco BE85
TP-Link Deco BE65
TP-Link Deco BE65 Pro
TP-Link Deco BE25
TP-Link Deco BE23
TP-Link Deco BE25-Outdoor

Timeline

2025-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.