Description
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TP-Link Systems | Omada Software Controller | < 6.0.0.24 | 6.0.0.24 |
| TP-Link Systems | Omada OC200, OC220, OC300, OC400 | < 6.0.0.34 | 6.0.0.34 |
| TP-Link Systems | Omada cloud controller | < 6.0.0.100 | 6.0.0.100 |