15 TP-Link Bugs Expose Risks in Zero-Trust Provisioning

Researchers at Forescout discovered 15 vulnerabilities within TP-Link's ZTP (Zero-Touch Provisioning) ecosystem, primarily within their Omada networking devices. These vulnerabilities expose organizations to significant risks due to the centralized nature of ZTP, creating a single point of failure and enabling attackers to impersonate devices, steal credentials, and conduct lateral movement within a network. The issues require substantial system-wide changes to fix, and the researchers emphasize that ZTP should be treated with a zero-trust approach, not simply assumed to be secure.