PT-2026-4284 · Unknown · Omada Controller

Published 2026-01-22 · Updated 2026-03-16 · CVE-2025-9289

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Omada Controllers (affected versions not specified)

Description A Cross-Site Scripting (XSS) issue exists in a parameter within Omada Controllers because of insufficient input sanitization. Successful exploitation requires specific conditions, including network positioning or impersonating a trusted entity, and interaction from an authenticated administrator. An attacker could potentially execute arbitrary JavaScript code in the administrator's browser, which may lead to the disclosure of sensitive information and compromise confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9289

Affected Products

Omada Controller

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9289 · Security Note
• https://support.omadanetworks.com/us/document/114950 · Vendor Advisory
• https://support.omadanetworks.com/us/download · Patch
• https://twitter.com/VulmonFeeds/status/2014507187519860792 · Twitter Post
• https://twitter.com/CVEnew/status/2014577017661096016 · Twitter Post
• https://t.me/cveNotify/155534 · Telegram Post