PT-2026-4284 · Unknown · Omada Controller

CVE-2025-9289 · Publicado 2026-01-22 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Média

Vetor base

AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Omada Controllers (affected versions not specified)

Description A Cross-Site Scripting (XSS) issue exists in a parameter within Omada Controllers because of insufficient input sanitization. Successful exploitation requires specific conditions, including network positioning or impersonating a trusted entity, and interaction from an authenticated administrator. An attacker could potentially execute arbitrary JavaScript code in the administrator's browser, which may lead to the disclosure of sensitive information and compromise confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-9289

Produtos afetados

Omada Controller

Referências · 6

• https://twitter.com/VulmonFeeds/status/2014507187519860792 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9289 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014577017661096016 · Publicação no Twitter
• https://support.omadanetworks.com/us/document/114950 · Aviso do Fabricante
• https://support.omadanetworks.com/us/download · Correção
• https://t.me/cveNotify/155534 · Publicação no Telegram