CVE-2025-9292
Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers
- State
- Published
- Severity
- 2.0 Low
- Published
- Feb 13, 2026
- Updated
- Feb 13, 2026
- Reserved
- Aug 20, 2025
Description
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | TPLink |
Weaknesses
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
Affected Products
| Product | Versions |
|---|---|
Omada Cloud ControllerTP-Link Systems Inc. |
|
References
- https://www.tp-link.com/us/support/faq/4969/vendor-advisory
- https://www.omadanetworks.com/us/support/faq/4969/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.