CVE-2025-9289: Cross-Site Scripting (XSS) on Omada Controllers

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-22 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.

Affected products

TP-Link Oc200 Firmware: before 1.37.9; before 2.22.9 — fixed in 1.37.9, 2.22.9
TP-Link Oc220 Firmware: before 1.2.9 — fixed in 1.2.9
TP-Link Oc300 Firmware: before 1.31.9 — fixed in 1.31.9
TP-Link Oc400 Firmware: before 1.9.9 — fixed in 1.9.9
TP-Link Systems Inc. Omada Controller: before 6.0.0.24; before 6.0.0.100; before 6.0.0.34 — fixed in 6.0.0.100, 6.0.0.24, 6.0.0.34

How to fix

Upgrade to a fixed version: TP-Link Oc200 Firmware 1.37.9, 2.22.9; TP-Link Oc220 Firmware 1.2.9; TP-Link Oc300 Firmware 1.31.9; TP-Link Oc400 Firmware 1.9.9; TP-Link Systems Inc. Omada Controller 6.0.0.100, 6.0.0.24, 6.0.0.34. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9289 or the next vulnerability affects your stack