TP-Link Omada Products Authentication Weakness Vulnerability Allowing Interception and Forging of Adoption Traffic

An authentication weakness has been identified in TP-Link Omada Controllers, Gateways, and Access Points during the controller-device adoption process. This vulnerability arises from improper handling of random values, allowing an attacker with advanced network positioning to intercept adoption traffic and forge valid authentication through offline precomputation. As a result, sensitive information could be exposed, compromising confidentiality.

Impact

Exploitation of this vulnerability could lead to unauthorized interception of adoption traffic and forgery of authentication, potentially allowing attackers to access sensitive information and disrupt the normal functioning of the affected devices.

Remediation

Users are advised to download and update to the latest firmware version available on the TP-Link Omada Download Center. After upgrading, it is recommended to change the password to mitigate the risk of password leakage.