5.7Orta
CVE-2025-9289Cross-Site Scripting (XSS) on Omada Controllers
Açıklama
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
Zayıflık türü (CWE):
CWE-79
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| tp-link | oc200 firmware | < 1.37.9 | |
| tp-link | oc220 firmware | < 1.2.9 | |
| tp-link | oc300 firmware | < 1.31.9 | |
| tp-link | oc400 firmware | < 1.9.9 | |
| TP-Link Systems Inc. | Omada cloud controller | < 6.0.0.100 | |
| tp-link | omada controller | < 6.0.0.24 | |
| TP-Link Systems Inc. | Omada OC200, OC220, OC300, OC400 | < 6.0.0.34 | |
| TP-Link Systems Inc. | Omada Software Controller | < 6.0.0.24 |
Kaynaklar ve yamalar
- https://support.omadanetworks.com/us/download/ patchProduct
- https://support.omadanetworks.com/us/document/114950/ vendor-advisoryVendor Advisory
CPE eşleşmeleri (NVD) (8)
cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*< 6.0.0.24cpe:2.3:a:tp-link:omada_controller:*:*:*:*:cloud:*:*:*< 6.0.0.100cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:*< 1.37.9cpe:2.3:o:tp-link:oc220_firmware:*:*:*:*:*:*:*:*< 1.2.9cpe:2.3:o:tp-link:oc300_firmware:*:*:*:*:*:*:*:*< 1.31.9cpe:2.3:o:tp-link:oc400_firmware:*:*:*:*:*:*:*:*< 1.9.9cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:*< 2.22.9cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*< 6.0.0.34