CVE-2026-81531
Medium
Description
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.
SeverityMedium
CVSS6.9
Exploit probability—
ProductOmada Software Controller
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- TP-Link System Inc. Omada Software Controller6.3.0.45 or later
- TP-Link Systems Inc. OC200 V1(UN)_V1_1.42.10 Build 20260825 or later
- TP Link Systems Inc. OC200 v2(UN)_V2_2.27.10 Build 20260825 or later
- TP-Link Systems Inc OC200 v3(UN)_V3_3.4.10 Build 20260825 or later
- TP-Link Systems Inc. OC220 v1(UN)_V1_1.7.10 Build 20260825 or later
- TP-Link Systems Inc OC220 v2(UN)_V2_2.6.10 Build 20260825 or later
- TP-Link Systems Inc. OC300 v1(UN)_V1_1.36.10 Build 20260825 or later
- TP-Link Systems Inc. OC400 v1(UN)_V1_1.14.10 Build 20260825 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link System Inc. Omada Software Controller | v < 6.3.0.45 | 6.3.0.45 |
| TP-Link Systems Inc. OC200 V1 | v < (UN)_V1_1.42.10 Build 20260825 | (UN)_V1_1.42.10 Build 20260825 |
| TP Link Systems Inc. OC200 v2 | v < (UN)_V2_2.27.10 Build 20260825 | (UN)_V2_2.27.10 Build 20260825 |
| TP-Link Systems Inc OC200 v3 | v < (UN)_V3_3.4.10 Build 20260825 | (UN)_V3_3.4.10 Build 20260825 |
| TP-Link Systems Inc. OC220 v1 | v < (UN)_V1_1.7.10 Build 20260825 | (UN)_V1_1.7.10 Build 20260825 |
| TP-Link Systems Inc OC220 v2 | v < (UN)_V2_2.6.10 Build 20260825 | (UN)_V2_2.6.10 Build 20260825 |
| TP-Link Systems Inc. OC300 v1 | v < (UN)_V1_1.36.10 Build 20260825 | (UN)_V1_1.36.10 Build 20260825 |
| TP-Link Systems Inc. OC400 v1 | v < (UN)_V1_1.14.10 Build 20260825 | (UN)_V1_1.14.10 Build 20260825 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.