medium4.7
CVE-2025-9289
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization.
Impact
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Omada Controller | before 6.0.0.24 before 6.0.0.100 before 6.0.0.34 |
| Tp-Link | Oc200 Firmware | before 1.37.9 before 2.22.9 |
| Tp-Link | Oc220 Firmware | before 1.2.9 |
| Tp-Link | Oc300 Firmware | before 1.31.9 |
| Tp-Link | Oc400 Firmware | before 1.9.9 |