CVE-2025-9292

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9292", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2025-08-20T22:24:24.501Z", "datePublished": "2026-02-13T00:21:24.168Z", "dateUpdated": "2026-02-13T22:09:17.957Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Omada"], "product": "Omada Cloud Controller", "vendor": "TP-Link Systems Inc.", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required."}], "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information.\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-02-13T22:09:17.957Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.tp-link.com/us/support/faq/4969/"}, {"tags": ["vendor-advisory"], "url": "https://www.omadanetworks.com/us/support/faq/4969/"}], "source": {"discovery": "UNKNOWN"}, "title": "Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T13:18:18.233135Z", "id": "CVE-2025-9292", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T13:18:27.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9292", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-13T13:18:18.233135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T13:18:23.720Z"}}], "cna": {"title": "Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Omada Cloud Controller", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}], "platforms": ["Omada"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/us/support/faq/4969/", "tags": ["vendor-advisory"]}, {"url": "https://www.omadanetworks.com/us/support/faq/4969/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information.\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required.", "supportingMedia": [{"type": "text/html", "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-02-13T22:09:17.957Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9292", "state": "PUBLISHED", "dateUpdated": "2026-02-13T22:09:17.957Z", "dateReserved": "2025-08-20T22:24:24.501Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-02-13T00:21:24.168Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Omada"], "product": "Omada Cloud Controller", "vendor": "TP-Link Systems Inc.", "versions": [{"status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tp-link:aginet:*:*:*:*:*:*:*:*", "matchCriteriaId": "917B801C-D1EE-498D-9D89-7CD6FDF22096", "versionEndExcluding": "2.13.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:deco:*:*:*:*:*:*:*:*", "matchCriteriaId": "74600A45-B793-4C34-9C72-8BAED1555097", "versionEndExcluding": "3.9.163", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:festa:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C4235A8-87CF-48F8-B0BD-96124FDA850B", "versionEndExcluding": "1.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:kasa:*:*:*:*:*:*:*:*", "matchCriteriaId": "27D5C0B8-67C4-440B-A0B5-B0B4E8126DC5", "versionEndExcluding": "3.4.350", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:kidshield:*:*:*:*:*:*:*:*", "matchCriteriaId": "E50BF815-D85D-437C-891E-61B49F6E9AC5", "versionEndExcluding": "1.1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:omada:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B2DD98D-424D-453A-B472-9E7349E4B887", "versionEndExcluding": "4.25.25", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:omada_guard:*:*:*:*:*:*:*:*", "matchCriteriaId": "1EE9425F-E87A-4C39-8F4D-3CEEC10B92D6", "versionEndExcluding": "1.1.28", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:tapo:*:*:*:*:*:*:*:*", "matchCriteriaId": "857482B8-F8BA-4F53-BE48-55FC91FD32CF", "versionEndExcluding": "3.14.111", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:tether:*:*:*:*:*:*:*:*", "matchCriteriaId": "50BFDEFF-D76D-4AAB-8DDB-4620F5584A08", "versionEndExcluding": "4.12.27", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:tp-partner:*:*:*:*:*:*:*:*", "matchCriteriaId": "682309A2-16A9-483F-A789-0C1A412A7005", "versionEndExcluding": "2.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:tpcamera:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE3C3AA7-1F72-466B-B0AA-F26D43E4A301", "versionEndExcluding": "3.2.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:vigi:*:*:*:*:*:*:*:*", "matchCriteriaId": "3563E8AC-D931-4C07-BD5F-D35DB9BC8456", "versionEndExcluding": "2.7.70", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:wi-fi_navi:*:*:*:*:*:*:*:*", "matchCriteriaId": "51EF281C-A391-49C2-A826-F2C2E46D820D", "versionEndExcluding": "1.5.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:tp-link:wifi_toolkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFD2DCF8-1D59-478F-868D-3D503D68B009", "versionEndExcluding": "1.4.28", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information.\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required."}, {"lang": "es", "value": "Una configuraci\u00f3n de seguridad web permisiva puede permitir que las restricciones de origen cruzado impuestas por los navegadores modernos sean eludidas bajo circunstancias espec\u00edficas. La explotaci\u00f3n requiere la presencia de una vulnerabilidad de inyecci\u00f3n del lado del cliente existente y acceso de usuario a la interfaz web afectada. La explotaci\u00f3n exitosa podr\u00eda permitir la divulgaci\u00f3n no autorizada de informaci\u00f3n sensible. Corregido en versiones actualizadas del servicio Omada Cloud Controller desplegadas autom\u00e1ticamente por TP?Link. No se requiere ninguna acci\u00f3n del usuario."}], "id": "CVE-2025-9292", "lastModified": "2026-06-17T10:08:41.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9292", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T13:18:18.233135Z", "version": "2.0.3"}}]}, "published": "2026-02-13T02:16:45.937", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.omadanetworks.com/us/support/faq/4969/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/4969/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"created": "2026-02-13T21:28:53.098440+00:00", "updated": "2026-02-13T21:28:53.098513+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$omada_cloud_controller"]}