5.7Medium
CVE-2025-9289Cross-Site Scripting (XSS) on Omada Controllers
Description
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| tp-link | oc200 firmware | < 1.37.9 | |
| tp-link | oc220 firmware | < 1.2.9 | |
| tp-link | oc300 firmware | < 1.31.9 | |
| tp-link | oc400 firmware | < 1.9.9 | |
| TP-Link Systems Inc. | Omada cloud controller | < 6.0.0.100 | |
| tp-link | omada controller | < 6.0.0.24 | |
| TP-Link Systems Inc. | Omada OC200, OC220, OC300, OC400 | < 6.0.0.34 | |
| TP-Link Systems Inc. | Omada Software Controller | < 6.0.0.24 |
References and patches
- https://support.omadanetworks.com/us/download/ patchProduct
- https://support.omadanetworks.com/us/document/114950/ vendor-advisoryVendor Advisory
CPE matches (NVD) (8)
cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*< 6.0.0.24cpe:2.3:a:tp-link:omada_controller:*:*:*:*:cloud:*:*:*< 6.0.0.100cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:*< 1.37.9cpe:2.3:o:tp-link:oc220_firmware:*:*:*:*:*:*:*:*< 1.2.9cpe:2.3:o:tp-link:oc300_firmware:*:*:*:*:*:*:*:*< 1.31.9cpe:2.3:o:tp-link:oc400_firmware:*:*:*:*:*:*:*:*< 1.9.9cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:*< 2.22.9cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*< 6.0.0.34