CVE-2025-9289

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.

• Tp Link Oc200

  HW
  Tp-Link
  12

• Tp Link Oc200 Firmware

  OS
  Tp-Link
  < 2.22.9< 1.37.9

• Tp Link Oc220

  HW
  Tp-Link
  1

• Tp Link Oc220 Firmware

  OS
  Tp-Link
  < 1.2.9

• Tp Link Oc300

  HW
  Tp-Link
  1.6

• Tp Link Oc300 Firmware

  OS
  Tp-Link
  < 1.31.9

• Tp Link Oc400

  HW
  Tp-Link
  1.6

• Tp Link Oc400 Firmware

  OS
  Tp-Link
  < 1.9.9

• Tp Link Omada Controller

  APP
  Tp-Link
  < 6.0.0.34< 6.0.0.100< 6.0.0.24