Loading vulnerability…
Cross-channel scripting in TP-Link Omada Controllers
CVE-2025-9289 is a cross-site scripting vulnerability affecting TP-Link Omada hardware, software, and cloud-based controllers. Improper sanitization of device-adoption values allows attacker-controlled JavaScript to reach the controller web interface and execute in an authenticated administrator’s browser. Exploitation requires advanced conditions, such as suitable network positioning or impersonation of a trusted entity, together with administrator interaction. Successful exploitation can expose controller data or facilitate credential theft through fraudulent login prompts.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can execute arbitrary JavaScript in an authenticated administrator’s browser, potentially disclose sensitive controller information, and present fraudulent login prompts to steal administrator credentials. Stolen controller credentials can subsequently enable unauthorized management of network equipment or creation of VPN tunnels into internal networks. Root-level execution on managed devices requires chaining with separate vulnerabilities and is not a direct consequence of this XSS alone.
If you can’t patch tonight, do this now.
Restrict controller management access to trusted administrative networks, allowlisted sources, or VPN connections, and avoid direct internet exposure. Minimize administrator accounts and privileges, enable multifactor authentication, and avoid interacting with untrusted content while authenticated. Where feasible, use management-interface input filtering as a compensating control. Strengthen network segmentation and monitoring to reduce opportunities for device impersonation and detect suspicious provisioning or administrative activity.
Patch, then assume compromise.
Apply the vendor-provided Omada Controller update that addresses CVE-2025-9289 for the deployed controller type, and retest the affected device-adoption input after upgrading. Exact affected versions and fixed release numbers are not available. If compromise is suspected, rotate administrator and TP-Link ID credentials and any exposed VPN secrets.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.