Forescout's Vedere Labs discovered 15 vulnerabilities in TP-Link Omada's Zero-Touch Provisioning (ZTP) mechanism, disclosed at Black Hat USA. The flaws span four impact categories: client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications. Specific issues include hard-coded cryptographic keys, information disclosure, remote code execution, device hijacking and spoofing, client-side JavaScript injection, and interception or compromise of encrypted communications. When combined with two previously disclosed command-injection CVEs (CVE-2025-7850 and CVE-2025-7851), attackers can chain these flaws to compromise Omada's chain of trust. In one attack scenario: (1) An attacker enumerates predictable device serial numbers to obtain MAC addresses and identify unadopted devices. (2) The attacker impersonates a device, exploits a race condition during cloud adoption, and authenticates using default credentials. (3) The controller then discloses device configuration including cleartext usernames, unsalted MD5 password hashes, and potentially VPN keys. (4) The attacker injects JavaScript into the controller's admin interface to phish administrators and steal cloud-controller credentials. (5) With stolen credentials, the attacker reconfigures managed devices, creates VPN tunnels into the internal network, and exploits command-injection flaws to fully compromise network equipment. 11 of the 15 flaws received CVE identifiers; 4 did not (covering: device adoption based solely on serial number, default credentials during initial adoption, predictable serial numbers, and unauthenticated temporary download links). Over 1,800 internet-accessible Omada controllers were identified by Forescout despite not being intended for direct internet exposure.