Loading vulnerability…
Cross-origin restriction bypass in TP-Link Omada Cloud Controller Content Security Policy
CVE-2025-9292 is a web security misconfiguration in TP-Link Omada cloud-based controllers in which the Content Security Policy is overly permissive and allows connections to CloudFront and Amazon Web Services subdomains. Under specific circumstances, this permissive policy can be used to bypass browser-enforced cross-origin restrictions. The issue is not a standalone injection flaw; exploitation depends on the presence of an existing client-side injection vulnerability in the affected web interface. When chained with such an injection point, attacker-controlled script executing in the administrative interface can leverage the allowed outbound destinations to exfiltrate sensitive data or support credential-phishing workflows.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthorized disclosure of sensitive information from the affected web interface. In practical attack chains, the weakness can facilitate exfiltration of data accessible to the victim’s browser session and can support theft of administrator credentials when combined with client-side script injection in the controller interface.
If you can’t patch tonight, do this now.
Because the vulnerable component is the cloud-hosted controller service, no direct user action is required where the fixed service version has already been deployed. As defense in depth, organizations should eliminate related client-side injection paths in the controller interface, restrict administrative access to trusted users, enable multifactor authentication for administrator accounts, and monitor for suspicious administrative-interface activity that could indicate credential phishing or browser-session abuse.
Patch, then assume compromise.
TP-Link fixed the vulnerability in updated Omada Cloud Controller service versions. The remediation is delivered automatically as a service-side update to the cloud controller platform, and no customer-side patching action is required for the cloud-hosted service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.