Vulnerability · Published Feb 13, 2026 · Assigned by TPLink

CVE-2025-9292Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers

Low 2.0

In plain English

A low-severity security flaw in Omada Cloud Controller from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Omada Cloud Controller	0

Weakness: CWE-942 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.tp-link.com/us/support/faq/4969/ vendor-advisory
https://www.omadanetworks.com/us/support/faq/4969/ vendor-advisory