CVE-2025-9289
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
- Score
- CVSS 4.0 5.7 Medium
- Status
- Analyzed - f23511db-6c3e-4e32-a477-6aa17d310630
- Published
- 2026-01-22
- Last modified
- 2026-01-23
- Weaknesses
- CWE-79
Affected products
- Oc200 Firmware (Tp-link)
- Oc220 Firmware (Tp-link)
- Oc300 Firmware (Tp-link)
- Oc400 Firmware (Tp-link)
- Omada Controller (Tp-link)
- Oc220 (Tp-link Systems Inc.)
- Oc300 (Tp-link Systems Inc.)
- Oc400 (Tp-link Systems Inc.)
- Omada Cloud Controller (Tp-link Systems Inc.)
- Omada Oc200 (Tp-link Systems Inc.)
- Omada Software Controller (Tp-link Systems Inc.)
References
- https://support.omadanetworks.com/us/document/114950/
- https://support.omadanetworks.com/us/download/
