CVE-2025-9289

Description

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.

CVSS Details

CVSS Score

4.7

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:tp-link:omada_controller:*:*:*:*:cloud:*:*:* - VULNERABLE

cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:oc200:1:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:oc220_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:oc220:1:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:oc300_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:oc300:1.6:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:tp-link:oc400_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:oc400:1.6:*:*:*:*:*:*:* - NOT VULNERABLE

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

...

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-9289
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-9289
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-9289/
[4] VulDB https://vuldb.com/cve/CVE-2025-9289
[5] https://support.omadanetworks.com/us/document/114950/
[6] https://support.omadanetworks.com/us/download/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-9289", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "published": "2026-01-22T22:16:15.787", "lastModified": "2026-03-16T18:06:44.293", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) fue identificada en un parámetro en los Controladores Omada debido a una sanitización de entrada inadecuada. La explotación requiere condiciones avanzadas, como el posicionamiento en la red o la emulación de una entidad de confianza, y la interacción del usuario por parte de un administrador autenticado. Si tiene éxito, un atacante podría ejecutar JavaScript arbitrario en el navegador del administrador, exponiendo potencialmente información sensible y comprometiendo la confidencialidad."}], "metrics": {"cvssMetricV40": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 2.7}]}, "weaknesses": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tp-link:omada_controller:*:*:*:*:-:*:*:*", "versionEndExcluding": "6.0.0.24", "matchCriteriaId": "3B623F6F-B033-44B4-9F50-97CE3C0F84E1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tp-link:omada_controller:*:*:*:*:cloud:*:*:*", "versionEndExcluding": "6.0.0.100", "matchCriteriaId": "DB01AAAF-90A1-4DA2-8810-D5A02D11ABCC"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:oc200_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.37.9", "matchCriteriaId": "036DEE09-EB29-4F38-A472-181FE88A1EAC"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:oc200:1:*:*:*:*:*:*:*", "matchCriteriaId": "D994D0D1-FE36-4CB9-A641-CAAC8D643783"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:oc220_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.9", "matchCriteriaId": "1836F980-6E1F-4305-973E-AB34BD046CFD"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:oc220:1:*:*:*:*:*:*:*", "matchCriteriaId": "077DD2BF-32E3-434E-B040-9B4C48F419CA"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:oc300_firmware:*:*:*:*:*:*:*:*", ... (truncated)