Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-84941 EUVD-2026-75890GHSA-8qr5-rrw5-mq36

Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

Published Sep 10, 2026 · Updated Sep 11, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: OC200 v3 Product: OC2000 v1 Product: OC2000 v2 Product: OC220 v1 Product: OC220 v2 Product: OC300 v1 Product: OC400 v1 Product: Omada Software Controller (Linux) Product: Omada Software Controller (Windows) Platform: Linux Platform: Windows Category: Network devices

Description

An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

Affected products

VendorProductAffectedFixed
TP-Link Systems Omada Software Controller (Windows) < 6.2.14.11 6.2.14.11
TP-Link Systems Omada Software Controller (Linux) < 6.2.14.11 6.2.14.11
TP-Link Systems OC2000 v1 < 1.41.11 Build 20260711 1.41.11 Build 20260711
TP-Link Systems OC2000 v2 < 2.26.11 Build 20260711 2.26.11 Build 20260711
TP-Link Systems OC200 v3 < 3.3.11 Build 20260711 3.3.11 Build 20260711
TP-Link Systems OC220 v1 < 1.6.11 Build 20260711 1.6.11 Build 20260711
TP-Link Systems OC220 v2 < 2.5.11 Build 20260711 2.5.11 Build 20260711
TP-Link Systems OC300 v1 < 1.35.11 Build 20260711 1.35.11 Build 20260711
TP-Link Systems OC400 v1 < 1.13.11 Build 20260711 1.13.11 Build 20260711

References