XXE in TP-Link Systems Inc. Oc2000 V1
CVE-2026-84941
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Vulnerability class: XXE (XML External Entity)
Affected products
- Tp-link Systems Inc. Oc2000 V1
- Tp-link Systems Inc. Oc2000 V2
- Tp-link Systems Inc. Oc200 V3
- Tp-link Systems Inc. Oc220 V1
- Tp-link Systems Inc. Oc220 V2
- Tp-link Systems Inc. Oc300 V1
- Tp-link Systems Inc. Oc400 V1
- Tp-link Systems Inc. Omada Software Controller (Linux)
- Tp-link Systems Inc. Omada Software Controller (Windows)
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory)