CVE-2025-9289
Unknown Unknown - Not Provided
Cross-Site Scripting in Omada Controller Admin Parameter

Publication date: 2026-01-22

Last updated on: 2026-03-16

Assigner: TPLink

Description
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-03-16
Generated
2026-06-16
AI Q&A
2026-01-23
EPSS Evaluated
2026-06-14
NVD
CVE-2025-9289
EUVD
EUVD-2025-206326
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
tp-link omada_controller to 6.0.0.24 (exc)
tp-link omada_controller to 6.0.0.100 (exc)
tp-link oc200_firmware to 1.37.9 (exc)
tp-link oc220_firmware to 1.2.9 (exc)
tp-link oc300_firmware to 1.31.9 (exc)
tp-link oc400_firmware to 1.9.9 (exc)
tp-link oc200_firmware to 2.22.9 (exc)
tp-link omada_controller to 6.0.0.34 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Omada Controllers caused by improper input sanitization of a parameter. Exploiting it requires advanced conditions such as specific network positioning or impersonating a trusted entity, along with user interaction by an authenticated administrator. If exploited, an attacker can execute arbitrary JavaScript code in the administrator's browser.

Impact Analysis

If exploited, this vulnerability allows an attacker to run arbitrary JavaScript in the administrator's browser, which can lead to exposure of sensitive information and compromise the confidentiality of the system.

Compliance Impact

The vulnerability could potentially impact compliance with standards like GDPR and HIPAA because it allows execution of arbitrary JavaScript in an administrator's browser, which may lead to exposure of sensitive information and compromise confidentiality. This exposure could violate data protection requirements mandated by such regulations. However, exploitation requires advanced conditions and authenticated administrator interaction, which may limit the risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart