CVE-2025-15544 exposes site management credentials during the adoption handshake on TP-Link Omada Oc200 V3 controllers. Treat this as a catastrophic trust anchor failure, not a mere credential disclosure.
The credentials captured during adoption are not local device secrets — they are site management credentials that grant administrative authority over the entire Omada controller plane. Once compromised, an attacker can push configuration changes to every managed device (access points, switches, gateways), and those changes persist across firmware updates and reboots. This is owning the trust model itself, not a single device.
The CVSS 5.9 score is misleading because it treats adoption credentials as governing only the provisioning channel. In practice, these credentials scope-expand to control all downstream devices. The scope (S) metric in CVSS was designed for privilege boundary crossings, but here the same credential is both the entry point and the privilege boundary simultaneously — a structural mismatch the score doesn't capture.
More critically: there is likely no detection surface for this attack. Most SIEM and IDS rules have no logic for "legitimate management traffic exfiltrating credentials to an unexpected host." The adoption protocol executes briefly during provisioning, then lies dormant for the device's operational life — dormant code paths are among the least-monitored and least-audited in firmware stacks. The attack doesn't require active exploitation; it requires patience waiting for legitimate adoption events during network expansion or device replacement.
You cannot rotate site management credentials without potentially breaking existing installations — this is load-bearing infrastructure. Demand clarification from TP-Link on whether the adoption protocol assumes trusted network segments as a design constraint, and whether a secure-by-default adoption workflow (with manual certificate provisioning or controller attestation) is planned.
Prioritize network segmentation around the adoption channel, monitor for adoption traffic to unexpected destinations, and treat any adoption credential compromise as a full management plane compromise regardless of what the CVSS base score implies.