Forescout's Vedere Labs has disclosed 15 vulnerabilities affecting TP-Link Omada's Zero-Touch Provisioning (ZTP) mechanism. The flaws impact device onboarding, authentication, credential handling, certificate validation, and cryptographic trust. According to the researchers, attackers could chain multiple vulnerabilities to compromise ZTP controllers, cloud services, and managed devices, potentially enabling remote command execution, device hijacking, sensitive information disclosure, spoofing, and broader enterprise network infiltration. TP-Link has released security updates to address the identified issues and recommends users update affected devices immediately.