CVE-2026-81531

Deferred Deferred - Pending Action

Information Disclosure in Omada Controller

Publication date: 2026-09-08

Last updated on: 2026-09-21

Assigner: TPLink

Description

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-21

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-81531

Affected Vendors & Products

Vendor	Product	Version / Range
omada_controller	omada_controller	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure issue in Omada Controller. An API endpoint meant for Controller initialization remains accessible after use and may expose account-related information to unauthenticated remote users. Exploitation could allow attackers to query this endpoint remotely, potentially enabling user enumeration and further attacks on administrative accounts.

Impact Analysis

An attacker could exploit this to gather sensitive account details, such as usernames or roles, which may lead to unauthorized access or targeted attacks on administrative accounts. This could compromise the security of the Omada Controller system and its connected networks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating privacy requirements under GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately restrict access to the Omada Controller API endpoint used for initialization to prevent unauthenticated remote queries. Update to the latest patched version of Omada Controller as soon as it becomes available to address the information disclosure issue.

Hi! I’m here to help you understand CVE-2026-81531. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70