Zero Day Provisioning - Chaining TP Link ZTP Vulns

Zero-touch provisioning (ZTP) lets administrators onboard and configure network devices remotely, without a technician on site. The speakers from Forescout argue that this convenience rests on implicit trust, with a central controller as a single point of failure and proprietary protocols that vendors design without a standard. They picked TP-Link's Omada ecosystem because little public research covered it. To study it, they rooted client gateways through the web interface and reverse engineered the controller software, then mapped the discovery and adoption phases.

The protocol analysis turned up a chain of weaknesses. A legacy protocol version could be forced on controllers. Session keys had too little entropy to resist passive decryption, and the authentication hash could be captured and cracked offline. Keys and certificates were hard-coded, so one extracted certificate let a fake controller pass the chain-of-trust check. Factory default credentials during provisioning let an impersonated client be adopted, and the controller then handed out site credentials. Cloud adoption depended only on predictable serial numbers and was not bound to a state machine, which enabled a race condition, a stored XSS, and a content security policy bypass for phishing. Live demos showed a local root takeover and a remote phishing attack.

The vendor took 426 days to fix the issues, and 13 of the 17 received CVEs. The speakers recommend that vendors follow standards and avoid hard-coded keys, and that users enable multi-factor authentication, change defaults, rotate credentials and VPN keys, and apply updates.