PT-2026-4810 · Tp Link · Omada Controller

Published 2026-01-26 · Updated 2026-03-12 · CVE-2025-9522

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Omada Controllers (affected versions not specified)

Description A flaw exists in Omada Controllers related to the webhook functionality, allowing for Blind Server-Side Request Forgery (SSRF). This issue enables crafted requests to be sent to internal services, potentially leading to information disclosure through enumeration. The vulnerability allows an attacker to make requests on behalf of the server, accessing internal resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-01104

CVE-2025-9522

Affected Products

Omada Controller

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-9522 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9522 · Vendor Advisory
• https://support.omadanetworks.com/us/document/115200 · Vendor Advisory
• https://https//support.omadanetworks.com/us/download/software/omada-controller · Patch
• https://bdu.fstec.ru/vul/2026-01104 · Security Note
• https://twitter.com/VulmonFeeds/status/2015908091733156275 · Twitter Post
• https://twitter.com/dailycve/status/2031946626084872328 · Twitter Post
• https://t.me/cveNotify/155196 · Telegram Post
• https://twitter.com/CVEnew/status/2015876126095118709 · Twitter Post