Unauthenticated Account Information Disclosure in Multiple Omada Controllers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.3.0.45, (UN)_V1_1.42.10 Build 20260825, (UN)_V2_2.27.10 Build 20260825, (UN)_V3_3.4.10 Build 20260825, (UN)_V1_1.7.10 Build 20260825, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- TP-Link System Inc. Omada Software Controller
fixed in 6.3.0.45
- TP-Link Systems Inc. OC200 V1
fixed in (UN)_V1_1.42.10 Build 20260825
- TP Link Systems Inc. OC200 v2
fixed in (UN)_V2_2.27.10 Build 20260825
- TP-Link Systems Inc OC200 v3
fixed in (UN)_V3_3.4.10 Build 20260825
- TP-Link Systems Inc. OC220 v1
fixed in (UN)_V1_1.7.10 Build 20260825
- TP-Link Systems Inc OC220 v2
fixed in (UN)_V2_2.6.10 Build 20260825
- TP-Link Systems Inc. OC300 v1
fixed in (UN)_V1_1.36.10 Build 20260825
- TP-Link Systems Inc. OC400 v1
fixed in (UN)_V1_1.14.10 Build 20260825