Medium severity4.7NVD Advisory· Published Jan 22, 2026· Updated Jun 17, 2026
CVE-2025-9289
CVE-2025-9289
Description
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*range: <6.0.0.24
- cpe:2.3:a:tp-link:omada_controller:*:*:*:*:cloud:*:*:*range: <6.0.0.100
- Range: 0
Patches
Vulnerability mechanics
References
2- support.omadanetworks.com/us/document/114950/nvdVendor Advisory
- support.omadanetworks.com/us/download/nvdProduct
News mentions
2- 15 TP-Link Omada ZTP Flaws Enable Router Hijacking and Root Code ExecutionCyber Security News · Aug 5, 2026
- TP-Link patches Omada ZTP flaws allowing hackers to breach networksBleepingComputer · Aug 4, 2026