CVE-2026-81531

Summary

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. 

Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

Affected Software

VendorProductVersion RangeStatus
TP-Link System Inc.Omada Software Controller0 < 6.3.0.44affected
TP-Link Systems Inc.OC200 V10 < (UN)_V1_1.42.10 Build 20260825affected
TP Link Systems Inc.OC200 v20 < (UN)_V2_2.27.10 Build 20260825affected
TP-Link Systems IncOC200 v30 < (UN)_V3_3.4.10 Build 20260825affected
TP-Link Systems Inc.OC220 v10 < (UN)_V1_1.7.10 Build 20260825affected
TP-Link Systems IncOC220 v20 < (UN)_V2_2.6.10 Build 20260825affected
TP-Link Systems Inc.OC300 v10 < (UN)_V1_1.36.10 Build 20260825affected
TP-Link Systems Inc.OC400 v10 < (UN)_V1_1.14.10 Build 20260825affected

Weaknesses

  • CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References