« Volver al listado

CVE-2026-81531

Estado: AplazadaMedia (6.9)—

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.

Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tp-link — Omada ControllerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-81531",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-81531",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-08T17:21:39.911958Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link System Inc.",
          "product": "Omada Software Controller",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.3.0.45",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "OC200 V1",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V1_1.42.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP Link Systems Inc.",
          "product": "OC200 v2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V2_2.27.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc",
          "product": "OC200 v3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V3_3.4.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "OC220 v1",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V1_1.7.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc",
          "product": "OC220 v2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V2_2.6.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "OC300 v1",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V1_1.36.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "OC400 v1",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "(UN)_V1_1.14.10 Build 20260825",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-08T17:18:32.833",
  "references": [
    {
      "url": "https://support.omadanetworks.com/en/download/software/omada-controller/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://support.omadanetworks.com/us/document/133567/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://support.omadanetworks.com/us/download/software/omada-controller/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information\ndisclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization\nremains accessible after completion and may disclose account-related\ninformation to unauthenticated remote users. \n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to remote query the affected endpoint that\nmay facilitate user enumeration and subsequent attacks targeting administrative\naccounts."
    }
  ],
  "lastModified": "2026-09-21T18:17:10.900",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"
}