CVE-2025-9289
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
CVSS score4.7 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness type (CWE)CWE-79
Vendorstp-link
Affected products
| Vendors | Product | Versions |
|---|---|---|
| tp-link | omada controller | < 6.0.0.24 |
| tp-link | oc200 firmware | < 1.37.9 |
| tp-link | oc200 | 1 |
| tp-link | oc220 firmware | < 1.2.9 |
| tp-link | oc220 | 1 |
| tp-link | oc300 firmware | < 1.31.9 |
| tp-link | oc300 | 1.6 |
| tp-link | oc400 firmware | < 1.9.9 |
| tp-link | oc400 | 1.6 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.