Is CVE-2025-15628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15628 being exploited in the wild.

How severe is CVE-2025-15628?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Is there a fix for CVE-2025-15628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15628 attacked?

It is attacked over the network.

Am I affected by CVE-2025-15628?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15628: TP-Link Omada devices shared embedded certificate impersonation

CVE-2025-15628 · Severity: high · CVSS 7.5 · Published 2026-08-03

TP-Link Omada is a network management system that controls and monitors WiFi access points and network devices across corporate and institutional deployments. The system uses embedded certificates shared across all devices to establish secure communication. An attacker who obtains these certificates can impersonate legitimate controllers or devices, intercept sensitive traffic, and potentially compromise the entire managed network.

Quick answers

Is CVE-2025-15628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15628 being exploited in the wild.
How severe is CVE-2025-15628?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: TP-Link Omada <UNKNOWN>.
Is there a fix for CVE-2025-15628?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15628 attacked?: It is attacked over the network.
Am I affected by CVE-2025-15628?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the use of hardcoded, globally-shared embedded certificates across all Omada device deployments to establish trust relationships between controllers and managed devices. An attacker who obtains these certificates (through reverse engineering, firmware extraction, or disclosure) can cryptographically impersonate trusted devices or controllers without authentication. This allows man-in-the-middle attacks to intercept device-to-controller communications, potentially enabling credential theft, configuration changes, or lateral movement within managed networks. The vulnerability requires network access to the Omada network but no user interaction or authentication. Patch or fix availability has not been specified in available documentation.

Affected products

TP-Link Omada <UNKNOWN>

Timeline

2026-08-03: disclosed: Published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.