TI-2026-74509 Aliases CVE-2026-102298

Missing authorization in TP-Link Omada Controller MSP mode

LOW 35CWE-639Published 2026-10-14 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

TP-Link Omada Software Controller (Windows) from 0 before 6.3.0.45 fails to enforce a required permission check in MSP mode on its user-confirmation endpoint (CWE-862). An authenticated user can supply a caller-controlled identifier to validate credentials for other accounts. The responses distinguish nonexistent users, invalid passwords and successful authentication, which may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00437 38th percentileScored 2026-11-07

Fix Fixed Omada Software Controller (Windows) (TP-Link System Inc.): 6.3.0.45

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link System Inc.	Omada Software Controller (Windows)	before 6.3.0.45	6.3.0.45	Patch available	CNA

Omada Software Controller (Windows) VendorTP-Link System Inc. Affected before 6.3.0.45 Fixed in 6.3.0.45 Patch available CNA

Remediation

Upgrade TP-Link Omada Software Controller (Windows) to version 6.3.0.45, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Omada Software Controller (Windows) (TP-Link System Inc.) Fixed in 6.3.0.45

Timeline

2026-10-15 Threatist record created from CVE-2026-102298
2026-10-16 CISA SSVC decision points changed
2026-10-16 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

https://support.omadanetworks.com/us/document/136187/

TI-2026-65319 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration CVSS 4.0HIGH 8.5
TI-2026-56252 Unauthenticated Account Information Disclosure in Multiple Omada Controllers CVSS 4.0MEDIUM 6.9
TI-2025-10706 UPnP DOS in TL-WR940N V6 CVSS 4.0HIGH 7.1
TI-2026-69751 Plaintext storage of device private key in Tapo S505 firmware CVSS 4.0MEDIUM 5.4
TI-2026-53559 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3
TI-2026-53558 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences