Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 33

Export CSV
CVE-2026-102298

Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.  Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2026-107795

Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.  Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2026-84941

Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Oc2000 V1 Oc2000 V2 Oc200 V3 and 5 more
CVE-2025-9291

Improper Certificate Validation in TP-Link Omada Cloud Communications

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 218 more
CVE-2025-15544

Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Omada App Omada Controller and 228 more
CVE-2025-15627

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Controller Omada Ds1008x Omada Ds1008x Firmware and 225 more
CVE-2025-15628

Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Points Omada Controller Omada Ds1008x and 226 more
CVE-2025-15629

Weak Session Key Generation in TP-Link Omada Adoption Protocol

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15630

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15631

Weak Credential Storage in TP-Link Omada Devices

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 219 more
CVE-2026-1668

Input Validation Vulnerability on Multiple Omada Switches

The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.

CVSS 4.0 · 7.7 High EPSS 1.0% KEV · Not listed
Vendors
Tp-link
Products
Omada Sg2005p-pd Omada Sg2005p-pd Firmware Omada Sg2008 and 114 more
CVE-2025-9292

Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Aginet Deco Festa and 12 more
CVE-2025-9293

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Aginet Aginet App Deco and 21 more
CVE-2025-9290

Authentication Weakness on Omada Controllers, Gateways and Access Points

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Beam Bridge 5 Ur Beam Bridge 5 Ur Firmware Dr3220v-4g and 111 more
CVE-2025-9289

Cross-Site Scripting (XSS) on Omada Controllers

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Oc200 Oc200 Firmware Oc220 and 7 more
CVE-2025-9520

IDOR Leading to Owner Account Hijacking in Omada Controller

An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Controller
CVE-2025-9521

Password Confirmation Bypass in Omada Controller

Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Controller
CVE-2025-9522

Blind Server-Side Request Forgery (SSRF) in Omada Controller

Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Controller
CVE-2025-7375

Unauthenticated Denial-of-Service Vulnerability in Omada EAP610

A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610 firmware versions prior to 1.6.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eap610 V3 Omada Eap610 Omada Eap610 Firmware
CVE-2025-7851

Unauthorized root access via debug functionality

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Er605 Er605 Firmware Er706w and 24 more