VulnerabilityAnalyzed

CVE-2025-9289

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization.

MEDIUM 5.7EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.

CVSS 4.0: 5.7 MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: tp-link/omada controller · tp-link/oc200 firmware · tp-link/oc220 firmware · tp-link/oc300 firmware · tp-link/oc400 firmware
Source: f23511db-6c3e-4e32-a477-6aa17d310630

References

https://support.omadanetworks.com/us/document/114950/Vendor Advisory
https://support.omadanetworks.com/us/download/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.