CVE-2025-9292 (GCVE-0-2025-9292)

Vulnerability from cvelistv5 – Published: 2026-02-13 00:21 – Updated: 2026-02-13 22:09
VLAI?
Title
Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers
Summary
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
Severity ?
2 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-942 - Permissive Cross-domain Security Policy with Untrusted Domains
Assigner
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. Omada Cloud Controller Affected: 0 (custom)
Create a notification for this product.
Credits
Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-13T13:18:18.233135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-13T13:18:27.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Omada"
          ],
          "product": "Omada Cloud Controller",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.  Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.  Successful exploitation could allow unauthorized disclosure of sensitive information.\u0026nbsp;Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required."
            }
          ],
          "value": "A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.  Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.  Successful exploitation could allow unauthorized disclosure of sensitive information.\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-13T22:09:17.957Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/4969/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.omadanetworks.com/us/support/faq/4969/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2025-9292",
    "datePublished": "2026-02-13T00:21:24.168Z",
    "dateReserved": "2025-08-20T22:24:24.501Z",
    "dateUpdated": "2026-02-13T22:09:17.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-9292\",\"sourceIdentifier\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"published\":\"2026-02-13T02:16:45.937\",\"lastModified\":\"2026-04-01T20:52:43.110\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.  Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.  Successful exploitation could allow unauthorized disclosure of sensitive information.\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\u2011Link. No user action is required.\"},{\"lang\":\"es\",\"value\":\"Una configuraci\u00f3n de seguridad web permisiva puede permitir que las restricciones de origen cruzado impuestas por los navegadores modernos sean eludidas bajo circunstancias espec\u00edficas. La explotaci\u00f3n requiere la presencia de una vulnerabilidad de inyecci\u00f3n del lado del cliente existente y acceso de usuario a la interfaz web afectada. La explotaci\u00f3n exitosa podr\u00eda permitir la divulgaci\u00f3n no autorizada de informaci\u00f3n sensible. Corregido en versiones actualizadas del servicio Omada Cloud Controller desplegadas autom\u00e1ticamente por TP?Link. No se requiere ninguna acci\u00f3n del usuario.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.0,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-942\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:aginet:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.13.6\",\"matchCriteriaId\":\"917B801C-D1EE-498D-9D89-7CD6FDF22096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:deco:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.9.163\",\"matchCriteriaId\":\"74600A45-B793-4C34-9C72-8BAED1555097\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:festa:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.7.1\",\"matchCriteriaId\":\"8C4235A8-87CF-48F8-B0BD-96124FDA850B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:kasa:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.4.350\",\"matchCriteriaId\":\"27D5C0B8-67C4-440B-A0B5-B0B4E8126DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:kidshield:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.21\",\"matchCriteriaId\":\"E50BF815-D85D-437C-891E-61B49F6E9AC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:omada:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.25.25\",\"matchCriteriaId\":\"6B2DD98D-424D-453A-B472-9E7349E4B887\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:omada_guard:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.28\",\"matchCriteriaId\":\"1EE9425F-E87A-4C39-8F4D-3CEEC10B92D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:tapo:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.14.111\",\"matchCriteriaId\":\"857482B8-F8BA-4F53-BE48-55FC91FD32CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:tether:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.12.27\",\"matchCriteriaId\":\"50BFDEFF-D76D-4AAB-8DDB-4620F5584A08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:tp-partner:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.1\",\"matchCriteriaId\":\"682309A2-16A9-483F-A789-0C1A412A7005\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:tpcamera:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.2.17\",\"matchCriteriaId\":\"BE3C3AA7-1F72-466B-B0AA-F26D43E4A301\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:vigi:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.70\",\"matchCriteriaId\":\"3563E8AC-D931-4C07-BD5F-D35DB9BC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:wi-fi_navi:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.5.5\",\"matchCriteriaId\":\"51EF281C-A391-49C2-A826-F2C2E46D820D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tp-link:wifi_toolkit:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.28\",\"matchCriteriaId\":\"BFD2DCF8-1D59-478F-868D-3D503D68B009\"}]}]}],\"references\":[{\"url\":\"https://www.omadanetworks.com/us/support/faq/4969/\",\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.tp-link.com/us/support/faq/4969/\",\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9292\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-13T13:18:18.233135Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-13T13:18:23.720Z\"}}], \"cna\": {\"title\": \"Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Omada Cloud Controller\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}], \"platforms\": [\"Omada\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.tp-link.com/us/support/faq/4969/\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.omadanetworks.com/us/support/faq/4969/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.  Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.  Successful exploitation could allow unauthorized disclosure of sensitive information.\\u00a0Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\\u2011Link. No user action is required.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.  Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.  Successful exploitation could allow unauthorized disclosure of sensitive information.\u0026nbsp;Fixed in updated Omada Cloud Controller service versions deployed automatically by TP\\u2011Link. No user action is required.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-942\", \"description\": \"CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains\"}]}], \"providerMetadata\": {\"orgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"shortName\": \"TPLink\", \"dateUpdated\": \"2026-02-13T22:09:17.957Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-9292\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-13T22:09:17.957Z\", \"dateReserved\": \"2025-08-20T22:24:24.501Z\", \"assignerOrgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"datePublished\": \"2026-02-13T00:21:24.168Z\", \"assignerShortName\": \"TPLink\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.