15 TP-Link Omada Flaws Exploit Zero-Touch Provisioning to Hijack Devices and Infiltrate Networks

Security researchers disclosed 15 vulnerabilities in TP-Link’s Omada zero-touch provisioning (ZTP) ecosystem — presented at Black Hat USA 2026 — that can enable device hijacking, controller compromise, credential exposure, and creation of access into internal networks. The findings include hard-coded private keys/certificates, predictable RC4 keys, insufficient certificate validation, serial-number enumeration and a cloud-adoption race condition, and affect Omada controllers, multiple TP-Link product lines and mobile apps; TP-Link has issued advisories and mitigations such as firmware/app updates, credential rotation, MFA, and network segmentation are recommended.