Tp-Link Omada Controller
6 CVEs affecting Tp-Link Omada Controller. Latest disclosed: 2026-01-26. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9520 | Medium | 6.8 | 2026-01-26 | An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owne… |
CVE-2025-9521 | Medium | 6.5 | 2026-01-26 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change t… |
CVE-2025-9290 | Medium | 5.9 | 2026-01-23 | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value… |
CVE-2020-12475 | Medium | 5.5 | 2020-05-04 | TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalController.getAdvertiseFile… |
CVE-2025-9522 | Medium | 5.3 | 2026-01-26 | Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to… |
CVE-2025-9289 | Medium | 4.7 | 2026-01-22 | A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advance… |