TP-Link Omada Cloud Controllers Cross-Origin Access Control Bypass Vulnerability

A permissive web security configuration in TP-Link Omada cloud controllers prior to version 4.25.25 may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could lead to the unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive information.

Remediation

Users with affected Omada Cloud deployments do not need to take any action, as updates are automatically applied to the cloud environment once validated by TP-Link.