Vulnerability · Published Jan 22, 2026 · Assigned by TPLink
CVE-2025-9289Cross-Site Scripting (XSS) on Omada Controllers
Medium 5.7
In plain English
A medium-severity cross-site scripting in Omada cloud controller from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Omada Software Controller | 0 – before 6.0.0.24 |
| TP-Link Systems Inc. | Omada OC200, OC220, OC300, OC400 | 0 – before 6.0.0.34 |
| TP-Link Systems Inc. | Omada cloud controller | 0 – before 6.0.0.100 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N