CVE-2025-9521 Details
Description
Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security.
A password confirmation bypass vulnerability has been identified in Omada Controllers, affecting versions prior to 6.0. This vulnerability allows an attacker with a valid session token to bypass secondary verification processes when changing a user's password. As a result, the password can be altered without proper confirmation, leading to a reduction in account security.
Users are advised to update to version 6.0 or later. The latest version can be downloaded from the Omada Network Support website.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.omadanetworks.com/us/document/115200/ | TPLink | Vendor Advisory |
| https://support.omadanetworks.com/us/download/software/omada-controller/ | TPLink | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | TPLink |
Affected Products
| Product | Versions |
|---|---|
| tp-link omada controller | < 6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | TPLink |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Jan 26, 2026 | New CVE Received | TPLink |