CVE-2025-9292
High
Description
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Tp-link Omada
PublishedFeb 13, 2026
First seenFeb 13, 2026
Weakness typeCWE-942CWE-942
How to fix
Update
- tp-link omada4.25.25 or later
- tp-link aginet2.13.6 or later
- tp-link deco3.9.163 or later
- tp-link festa1.7.1 or later
- tp-link kasa3.4.350 or later
- tp-link kidshield1.1.21 or later
- tp-link omada_guard1.1.28 or later
- tp-link tapo3.14.111 or later
- tp-link tether4.12.27 or later
- tp-link tp-partner2.0.1 or later
- tp-link tpcamera3.2.17 or later
- tp-link vigi2.7.70 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link omada | v < 4.25.25 | 4.25.25 |
| tp-link aginet | v < 2.13.6 | 2.13.6 |
| tp-link deco | v < 3.9.163 | 3.9.163 |
| tp-link festa | v < 1.7.1 | 1.7.1 |
| tp-link kasa | v < 3.4.350 | 3.4.350 |
| tp-link kidshield | v < 1.1.21 | 1.1.21 |
| tp-link omada_guard | v < 1.1.28 | 1.1.28 |
| tp-link tapo | v < 3.14.111 | 3.14.111 |
| tp-link tether | v < 4.12.27 | 4.12.27 |
| tp-link tp-partner | v < 2.0.1 | 2.0.1 |
| tp-link tpcamera | v < 3.2.17 | 3.2.17 |
| tp-link vigi | v < 2.7.70 | 2.7.70 |
| tp-link wi-fi_navi | v < 1.5.5 | 1.5.5 |
| tp-link wifi_toolkit | v < 1.4.28 | 1.4.28 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.