IDOR Vulnerability in Omada Controllers by TP-Link
CVE-2025-9520

8.3HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Omada Controller
Vendor
CVE Published:
26 January 2026

What is CVE-2025-9520?

An insecure direct object reference (IDOR) vulnerability has been identified in Omada Controllers by TP-Link, allowing administrators to manipulate requests. This can result in unauthorized access, where an attacker with administrative permissions may hijack the Owner account. Such vulnerabilities can lead to severe data breaches and compromise sensitive information if left unaddressed. It is crucial for users to apply the latest security patches and follow best practices in access management.

Affected Version(s)

Omada Controller 0 < 6.0

References

https://support.omadanetworks.com/us/document/115200/
vendor-advisory
https://support.omadanetworks.com/us/download/software/om...
patch

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eduardo Bido on behalf of Thoropass
.