Omada Controllers IDOR Vulnerability Allowing Owner Account Hijacking

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Omada Controllers, affecting versions prior to 6.0. This vulnerability allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account. Exploitation of this vulnerability could lead to a full takeover of the Owner account, granting complete administrative control over the Omada Controller and connected services.

Impact

Exploitation of this vulnerability could result in a full takeover of the Owner account, allowing the attacker to gain complete administrative control over the Omada Controller and its connected services.

Remediation

Users are advised to update to version 6.0 or later. The latest version can be downloaded from the Omada Network Support website.