CVE-2025-9292 - CVE House
Back to Database
Status published Low CVE-2025-9292

Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers

Vulnerability Description

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9292

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies

References

More from TP-Link Systems Inc.

View All →
CVE-2025-9961
Authenticated RCE by CWMP binary
High 8.6
CVE-2025-9522
Blind Server-Side Request Forgery (SSRF) in Omada Controller
Medium 5.1
CVE-2025-9521
Password Confirmation Bypass in Omada Controller
Low 2.1
CVE-2025-9520
IDOR Leading to Owner Account Hijacking in Omada Controller
High 8.3
CVE-2025-9377
Authenticated RCE via Parental Control command injection
High 8.6

Affected Vendor

TP-Link Systems Inc.

View all reports →

Affected Software

Omada Cloud Controller
Vulnerable Versions:
0

Timeline

Official Publish: February 13th, 2026
Last Modified: February 13th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-942

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.