CVE-2026-81531

Unauthenticated Account Information Disclosure in Multiple Omada Controllers

State: Published
Severity: 6.9 Medium
Published: Sep 8, 2026
Updated: Sep 21, 2026
Reserved: Aug 26, 2026

Description

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.

Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	TPLink

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Omada Software ControllerTP-Link System Inc.	before 6.3.0.45Affected
OC200 V1TP-Link Systems Inc.	before (UN)_V1_1.42.10 Build 20260825Affected
OC200 v2TP Link Systems Inc.	before (UN)_V2_2.27.10 Build 20260825Affected
OC200 v3TP-Link Systems Inc	before (UN)_V3_3.4.10 Build 20260825Affected
OC220 v1TP-Link Systems Inc.	before (UN)_V1_1.7.10 Build 20260825Affected
OC220 v2TP-Link Systems Inc	before (UN)_V2_2.6.10 Build 20260825Affected
OC300 v1TP-Link Systems Inc.	before (UN)_V1_1.36.10 Build 20260825Affected
OC400 v1TP-Link Systems Inc.	before (UN)_V1_1.14.10 Build 20260825Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.