Unauthenticated account information disclosure in TP-Link Omada Controllers

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

• Omada Software Controller for Windows and Linux: versions less than 6.3.0.45 are affected; TP-Link identifies 6.3.0.45 as fixed.
• OC200 V1: versions less than (UN)_V1_1.42.10 Build 20260825 are affected; the fixed firmware is (UN)_V1_1.42.10 Build 20260825.
• OC200 v2: versions less than (UN)_V2_2.27.10 Build 20260825 are affected; the fixed firmware is (UN)_V2_2.27.10 Build 20260825.
• OC200 v3: versions less than (UN)_V3_3.4.10 Build 20260825 are affected; the fixed firmware is (UN)_V3_3.4.10 Build 20260825.
• OC220 v1: versions less than (UN)_V1_1.7.10 Build 20260825 are affected; the fixed firmware is (UN)_V1_1.7.10 Build 20260825.
• OC220 v2: versions less than (UN)_V2_2.6.10 Build 20260825 are affected; the fixed firmware is (UN)_V2_2.6.10 Build 20260825.
• OC300 v1: versions less than (UN)_V1_1.36.10 Build 20260825 are affected; the fixed firmware is (UN)_V1_1.36.10 Build 20260825.
• OC400 v1: versions less than (UN)_V1_1.14.10 Build 20260825 are affected; the fixed firmware is (UN)_V1_1.14.10 Build 20260825.

An earlier NVD rendering supplied through GCVE showed a different Omada Software Controller boundary, less than 6.3.0.44. The TP-Link advisory and supplied normalized facts identify 6.3.0.45 as the fix, so the vendor boundary should be used for exposure assessment. The status of parallel release branches or versions not listed here remains unconfirmed.

The listed TP-Link Omada Software Controller and hardware controllers expose an API endpoint intended for Controller initialization after initialization has completed. An unauthenticated remote attacker can query that endpoint and obtain account-related information. This is an exposure of sensitive information to an unauthorized actor, consistent with CWE-200. The available description does not identify the endpoint path, HTTP method, request parameters, response format, or the exact fields disclosed. Continued availability after initialization suggests a possible failure to disable or restrict the endpoint based on controller state, but that implementation detail is not confirmed.

The flaw is remotely reachable over the network without authentication or user interaction. The supplied record characterizes the attack complexity as low, but it does not disclose a request, endpoint path, or exploit sequence. The supplied record does not identify a public exploit or mark the products as known exploited; the CISA enrichment returned during research records exploitation as none. That status does not prove that unreported abuse has not occurred.

The confirmed direct outcome is disclosure of account-related information, primarily affecting confidentiality. The exposed data may support user enumeration and improve targeting of administrative accounts. The vulnerability is not described as directly providing configuration-modification privileges, code execution, or loss of controller availability. The record also does not confirm disclosure of passwords, tokens, complete credentials, or successful account takeover. Because the endpoint can be queried remotely without authentication, deployments with management interfaces exposed beyond trusted networks should receive priority review.

Disclosure of account-related information can help an attacker identify users or administrative accounts present in the environment. That information may improve follow-on attacks against management interfaces, such as password spraying or phishing, but the record does not establish that such attacks occurred. The vulnerability is not described as directly enabling data modification or service interruption. Practical risk is higher where the controller management interface is reachable from an untrusted network.

1. Update each product branch to its confirmed fix: update Omada Software Controller to 6.3.0.45; OC200 V1 to (UN)_V1_1.42.10 Build 20260825; OC200 v2 to (UN)_V2_2.27.10 Build 20260825; OC200 v3 to (UN)_V3_3.4.10 Build 20260825; OC220 v1 to (UN)_V1_1.7.10 Build 20260825; OC220 v2 to (UN)_V2_2.6.10 Build 20260825; OC300 v1 to (UN)_V1_1.36.10 Build 20260825; and OC400 v1 to (UN)_V1_1.14.10 Build 20260825.
2. Follow TP-Link Download Center instructions and confirm after deployment that the correct model, hardware revision, and software branch were updated.
3. If immediate updating is not possible, reduce access from untrusted networks to the management interface as a precaution. This is exposure reduction, not a workaround confirmed by TP-Link in the advisory.
4. Do not assume that a fix for one branch covers the other hardware or software branches. Verify each product against the list above.

1. Inventory TP-Link Omada Software Controller deployments on Windows and Linux, together with OC200, OC220, OC300, and OC400 hardware controllers.
2. Compare installed software or firmware versions with the affected boundaries and exact fixes listed in affected_summary.
3. Identify management interfaces reachable from untrusted networks and, using TP-Link documentation, determine whether the Controller initialization API remains accessible after initialization is complete.
4. Review reverse-proxy, firewall, and controller logs for unauthenticated requests to the initialization API or repeated query patterns consistent with user enumeration. This is precautionary monitoring, not a vendor-confirmed indicator.
5. The researched advisory does not provide an endpoint path, log signature, or IOC. Absence of matching log evidence does not prove that a system is safe.