Omada Controller (Tp-link) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2026-01-26. Vendor: Tp-link.

CVEs of Omada Controller

• CVE-2025-9522 - CVSS 5.3 (medium), 2026-01-26: Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to…
• CVE-2025-9521 - CVSS 6.5 (medium), 2026-01-26: Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change…
• CVE-2025-9520 - CVSS 8.3 (high), 2026-01-26: An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the…
• CVE-2025-9290 - CVSS 6 (medium), 2026-01-23: An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random…
• CVE-2025-9289 - CVSS 5.7 (medium), 2026-01-22: A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires…
• CVE-2020-12475 - CVSS 5.5 (medium), 2020-05-04: TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via…