CVE-2025-9522

Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of information.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - f23511db-6c3e-4e32-a477-6aa17d310630

Published

2026-01-26

Last modified

2026-02-03

Weaknesses

CWE-918

Affected products

• Omada Controller (Tp-link)
• Omada Controller (Tp-link Systems Inc.)

References

• https://https://support.omadanetworks.com/us/download/software/omada-controller/
• https://support.omadanetworks.com/us/document/115200/