8.3High
CVE-2025-9520IDOR Leading to Owner Account Hijacking in Omada Controller
Description
An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.
Weakness (CWE):
CWE-639
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| TP-Link Systems Inc. | Omada Controller | < 6.0 |
References and patches
- https://support.omadanetworks.com/us/document/115200/ vendor-advisoryVendor Advisory
- https://support.omadanetworks.com/us/download/software/omada-controller/ patchProduct
CPE matches (NVD) (1)
cpe:2.3:o:tp-link:omada_controller:*:*:*:*:*:*:*:*< 6.0