CVE-2025-9289mediumCWE-79

CVE-2025-9289: falha de média gravidade em TP-Link Systems Inc. Omada cloud controller

Cross-Site Scripting (XSS) on Omada Controllers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OC300+ Monitorar OC400

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.7epss 0.2%
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
TP-Link Systems Inc. · Omada cloud controllerTP-Link Systems Inc. · Omada OC200, OC220, OC300, OC400TP-Link Systems Inc. · Omada Software Controller
CVEs relacionadas — TP-Link Systems Inc. Omada cloud controller

No mesmo produto, das mais perigosas para as menos.

CVE-2026-107795HIGHImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management APIEPSS 0.2%CVE-2025-9290MEDIUMAuthentication Weakness on Omada Controllers, Gateways and Access PointsEPSS 0.2%