Unauthenticated Account Information Disclosure in Multiple Omada Controllers
Priority LOW 38CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00666 52nd percentileScored 2026-11-07
Fix Fixed Omada Software Controller (TP-Link System Inc.): 6.3.0.45OC200 V1 (TP-Link Systems Inc.): (UN)_V1_1.42.10 Build 20260825+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TP-Link System Inc. | Omada Software Controller | before 6.3.0.45 | 6.3.0.45 | Patch available | CNA |
| TP-Link | OC200 V1 | before (UN)_V1_1.42.10 Build 20260825 | (UN)_V1_1.42.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC200 v2 | before (UN)_V2_2.27.10 Build 20260825 | (UN)_V2_2.27.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC200 v3 | before (UN)_V3_3.4.10 Build 20260825 | (UN)_V3_3.4.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC220 v1 | before (UN)_V1_1.7.10 Build 20260825 | (UN)_V1_1.7.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC220 v2 | before (UN)_V2_2.6.10 Build 20260825 | (UN)_V2_2.6.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC300 v1 | before (UN)_V1_1.36.10 Build 20260825 | (UN)_V1_1.36.10 Build 20260825 | Patch available | CNA |
| TP-Link | OC400 v1 | before (UN)_V1_1.14.10 Build 20260825 | (UN)_V1_1.14.10 Build 20260825 | Patch available | CNA |
- Omada Software Controller VendorTP-Link System Inc. Affected before 6.3.0.45 Fixed in 6.3.0.45 Patch available CNA
- OC200 V1 VendorTP-Link Affected before (UN)_V1_1.42.10 Build 20260825 Fixed in (UN)_V1_1.42.10 Build 20260825 Patch available CNA
- OC200 v2 VendorTP-Link Affected before (UN)_V2_2.27.10 Build 20260825 Fixed in (UN)_V2_2.27.10 Build 20260825 Patch available CNA
- OC200 v3 VendorTP-Link Affected before (UN)_V3_3.4.10 Build 20260825 Fixed in (UN)_V3_3.4.10 Build 20260825 Patch available CNA
- OC220 v1 VendorTP-Link Affected before (UN)_V1_1.7.10 Build 20260825 Fixed in (UN)_V1_1.7.10 Build 20260825 Patch available CNA
- OC220 v2 VendorTP-Link Affected before (UN)_V2_2.6.10 Build 20260825 Fixed in (UN)_V2_2.6.10 Build 20260825 Patch available CNA
- OC300 v1 VendorTP-Link Affected before (UN)_V1_1.36.10 Build 20260825 Fixed in (UN)_V1_1.36.10 Build 20260825 Patch available CNA
- OC400 v1 VendorTP-Link Affected before (UN)_V1_1.14.10 Build 20260825 Fixed in (UN)_V1_1.14.10 Build 20260825 Patch available CNA
Remediation
- Fix · CNA Omada Software Controller (TP-Link System Inc.) Fixed in 6.3.0.45
- Fix · CNA OC200 V1 (TP-Link Systems Inc.) Fixed in (UN)_V1_1.42.10 Build 20260825
- Fix · CNA OC200 v2 (TP Link Systems Inc.) Fixed in (UN)_V2_2.27.10 Build 20260825
- Fix · CNA OC200 v3 (TP-Link Systems Inc) Fixed in (UN)_V3_3.4.10 Build 20260825
- Fix · CNA OC220 v1 (TP-Link Systems Inc.) Fixed in (UN)_V1_1.7.10 Build 20260825
- Fix · CNA OC220 v2 (TP-Link Systems Inc) Fixed in (UN)_V2_2.6.10 Build 20260825
- Fix · CNA OC300 v1 (TP-Link Systems Inc.) Fixed in (UN)_V1_1.36.10 Build 20260825
- Fix · CNA OC400 v1 (TP-Link Systems Inc.) Fixed in (UN)_V1_1.14.10 Build 20260825
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81531
- 2026-10-03 Alias added: GHSA-2pv5-9q5x-x59w
References
More TP-Link System Inc. vulnerabilities
- TI-2026-65319 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration CVSS 4.0HIGH 8.5
- TI-2026-74509 Missing authorization in TP-Link Omada Controller MSP mode CVSS 4.0HIGH 7.5
- TI-2025-10706 UPnP DOS in TL-WR940N V6 CVSS 4.0HIGH 7.1
- TI-2026-69751 Plaintext storage of device private key in Tapo S505 firmware CVSS 4.0MEDIUM 5.4
- TI-2026-53559 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3
- TI-2026-53558 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-81531 · CVE Program
- CVE-2026-81531 · NVD
- FIRST EPSS
- GHSA-2pv5-9q5x-x59w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences