Is CVE-2025-15630 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15630 being exploited in the wild.

How severe is CVE-2025-15630?

Medium severity, with a CVSS score of 5.9, published 3 August 2026.

Which products and versions are affected?

TP-Link Omada Cloud; TP-Link Deco BE85; TP-Link Deco BE65; TP-Link Deco BE65-PoE; and 3 more.

Is there a fix for CVE-2025-15630?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15630 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-15630?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15630: TP-Link Omada cloud device adoption race condition

CVE-2025-15630 · Severity: medium · CVSS 5.9 · Published 2026-08-03

TP-Link's Omada cloud platform handles the onboarding process for networking devices like mesh routers and access points. An attacker can exploit a timing vulnerability during device registration to intercept provisioning information intended for legitimate devices, potentially gaining unauthorized access to configuration details and network credentials.

Quick answers

Is CVE-2025-15630 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15630 being exploited in the wild.
How severe is CVE-2025-15630?: Medium severity, with a CVSS score of 5.9, published 3 August 2026.
Which products and versions are affected?: TP-Link Omada Cloud; TP-Link Deco BE85; TP-Link Deco BE65; TP-Link Deco BE65-PoE; and 3 more.
Is there a fix for CVE-2025-15630?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15630 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-15630?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in the cloud-based Omada device adoption workflow that allows an attacker to interact with the registration process before a legitimate device completes enrollment. The vulnerability is triggered during the adoption phase when provisioning information is allocated but not yet tied to a specific authenticated device. An attacker can initiate the adoption workflow and receive the provisioning data meant for the legitimate device. The attack requires network access to the Omada cloud service and the ability to initiate device adoption requests, but does not require prior authentication or compromise of the target device.

Affected products

TP-Link Omada Cloud
TP-Link Deco BE85
TP-Link Deco BE65
TP-Link Deco BE65-PoE
TP-Link Deco BE65 Pro
TP-Link Deco BE25
TP-Link Deco BE23

Timeline

2025-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.