Black Hat USA 2026 – Las Vegas – Researchers disclosed 15 vulnerabilities in TP-Link networking technologies that they say call into question organizations’ blind trust in zero-touch provisioning (ZTP).
TP-Link is one of the world’s largest edge device manufacturers. According to the company, its products are used by 1.7 billion people in more than 170 countries. In years past, TP-Link has enjoyed billion-dollar annual sales figures, with somewhere between 15% and 45% of the global market share for wireless local area network (WLAN) tech. The company has even had to play down its ubiquity in recent years, for political purposes.
At Black Hat this week, Forescout’s Vedere Labs security researchers Stanislav Dashevskyi and Francesco La Spina revealed 15 vulnerabilities affecting TP-Link “Omada” — the software-defined networking (SDN) ecosystem for TP-Link’s routers, switches, gateways, and Wi-Fi access points. The issues aren’t so much about the devices, though, as they are the process of onboarding and provisioning them. That’s why, more than any specific vulnerability or exploit chain, the researchers are calling attention to ZTP, the trendy and convenient process by which organizations set up their TP-Link tech in the first place.
“ZTP does not inherently expand the attack surface, but it can dramatically increase it in practice by collapsing many independent trust decisions into a single automated provisioning flow,” La Spina explains. “That creates a high-value point of compromise, and chained weaknesses can enable a large-scale network or supply chain intrusion.”
ZTP: The Good, the Bad, and the Ugly
Remember the last time you got Wi-Fi service for your home? A technician from your Internet service provider (ISP) came over and took somewhere between 20 minutes and a couple of hours to set everything up.
Setting up networking devices is a chore, but at least consumers only have to get it done once in a while. Organizations, however, have to do it often. It’s also becoming more and more common for organizations to expand geographically, meaning they have to deploy lots of remote devices all over the place. If only there were a way to configure equipment automatically, out of the box.
That’s the idea behind the otherwise self-descriptive term “zero-touch provisioning.” Instead of going through a laborious, manual setup process for each new network device at your organization, network administrators can use a single provisioning server to automatically set up any number of new devices at any time, using predefined configuration data.
ZTP’s convenience is why it’s grown so rapidly, and why industry forecasts regularly project 100% to 200% more growth over the next decade. It also explains why some might not want to hear about its cybersecurity risks. As Forescout researchers explained in their newly published research, ZTP can expose organizations to insecure protocols, shared secrets, single points of failure — the provisioning servers — and attack paths that leverage overly trusted devices.
To demonstrate these risks, the researchers found a host of vulnerabilities in TP-Link’s ZTP-enabled Omada ecosystem, which could be combined to significant effect.
15 Newly Disclosed TP-Link Bugs
Broadly speaking, the TP-Link vulnerabilities can be grouped into four buckets: those that can enable device hijacking and spoofing, client-side code execution, disclosure of sensitive information, and encryption and chain of trust compromises. Most are of medium or high severity, according to the Common Vulnerability Scoring System (CVSS).
The point isn’t about one bug or another, Dashevskyi says. “It’s the variety of them that gives the potential attackers great opportunities to re-use Omada protocols for attacks, and adapt them for many possible scenarios including local attacks, attacks from the Internet via social engineering, and more.”
For instance, an unauthenticated, external attacker could use the fact that TP-Link device serial numbers are sequential — and therefore predictable — to impersonate a device that’s about to be adopted into an organization’s Omada system. Then they could exploit a race condition, spoofing its identity and connecting to the victim’s cloud network before the real device can, and authenticating by using TP-Link’s default username “admin” and password “admin.”
Having authenticated as an accepted device in Omada, the attacker will obtain cleartext configuration data and secrets, which they can use for lateral movement. They could also use their foothold to phish the network admin for their credentials and take over the whole system’s controller.
The researchers also outlined four possible attack scenarios for bad actors already inside of a network. Attackers could combine vulnerabilities in order to impersonate client devices or network controllers — and then perform remote code execution (RCE) as root — or control traffic entering and leaving Internet-facing gateways for man-in-the-middle (MiTM)-type attacks.
It’s also worth noting that TP-Link sells smart home devices and surveillance cameras, and they share elements of the same infrastructure with, and have similar protocols to, the networking devices. Thus the researchers found, for example, that TP-Link video management systems could be exploited much in the same way Omada network controllers are, enabling hackers to intercept and manipulate data transmitted between cameras and video recorders.
Not only were Forescout’s zero-days and vulnerability chains copious, but because some of them pertained to core design decisions in underlying Omada protocols, fixing them required significant, system-wide changes. Well over a year passed between Forescout’s initial report to the vendor, and the date by which all of the issues were settled.
Is ZTP Too Risky?
Forescout’s argument isn’t that ZTP is uniquely risky, or a bad thing overall. It’s not even about convenience versus security — that old, trite discourse. The researchers point is simply that ZTP cannot be implemented thoughtlessly.
The most common mistake organizations make in implementing ZTP, Dashevskyi says, “is trusting that the technology would just ‘work’ and there are no underlying vulnerabilities. ‘ZTP’ should probably stand for ‘Zero-Trust Provisioning’ and be treated as such.”
When managed carefully, La Spina says, “ZTP is still a net positive because it reduces manual work, speeds fleet rollout, and lowers human error. But those benefits depend on strong implementation, segmentation, secret hygiene, and threat modeling; otherwise, the central provisioning server becomes a high-blast-radius target that can be abused from within the trusted management zone.”
