Description
An information
disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization
remains accessible after completion and may disclose account-related
information to unauthenticated remote users.
Successful
exploitation may allow an attacker to remote query the affected endpoint that
may facilitate user enumeration and subsequent attacks targeting administrative
accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TP-Link System | Omada Software Controller | < 6.3.0.45 | 6.3.0.45 |
| TP-Link Systems | OC200 V1 | < (UN)_V1_1.42.10 Build 20260825 | (UN)_V1_1.42.10 Build 20260825 |
| TP Link Systems | OC200 v2 | < (UN)_V2_2.27.10 Build 20260825 | (UN)_V2_2.27.10 Build 20260825 |
| TP-Link Systems | OC200 v3 | < (UN)_V3_3.4.10 Build 20260825 | (UN)_V3_3.4.10 Build 20260825 |
| TP-Link Systems | OC220 v1 | < (UN)_V1_1.7.10 Build 20260825 | (UN)_V1_1.7.10 Build 20260825 |
| TP-Link Systems | OC220 v2 | < (UN)_V2_2.6.10 Build 20260825 | (UN)_V2_2.6.10 Build 20260825 |
| TP-Link Systems | OC300 v1 | < (UN)_V1_1.36.10 Build 20260825 | (UN)_V1_1.36.10 Build 20260825 |
| TP-Link Systems | OC400 v1 | < (UN)_V1_1.14.10 Build 20260825 | (UN)_V1_1.14.10 Build 20260825 |