EUVD-2026-101711
GHSA-wqgm-rp69-4p52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged authenticated session
-
DeliveryInvoke MSP/OpenAPI cert-management API
-
ExploitBypass missing admin authorization check
-
ExecutionUpload rogue or delete TLS cert/private key
-
ImpactDisrupt or hijack secure management access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the Omada Controller - the description states a low-privileged authenticated user is sufficient (which conflicts with the input vector's PR:H) - plus network reachability to the MSP or OpenAPI certificate/private-key management endpoints, which are the specific features lacking an administrative-authorization check. Exploitation is limited by the need for prior authentication and access to those API surfaces; deployments that do not enable the MSP/OpenAPI interfaces or that restrict management-plane network exposure materially reduce risk. No end-user interaction is required. |
| Impact | This is a broken-access-control flaw (CWE-284) in Omada Controller's MSP and OpenAPI certificate/private-key management APIs, where administrative authorization is not enforced, letting a lower-privileged authenticated user perform privileged certificate operations. Signals are mixed and incomplete: no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or widespread exploitation. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC:H/VI:H/VA:H, score 7.5) is internally inconsistent with the description: it specifies PR:H (high privileges) while the description explicitly states a 'low-privileged authenticated user' can exploit it - this contradiction materially changes the risk and should be verified with the vendor, since a low-privilege requirement makes the flaw substantially more exploitable than PR:H implies. The real-world impact is primarily integrity and availability of secure management (uploading a rogue certificate or deleting the controller's cert/private key), not mass data theft. Net assessment: a genuine, moderate-to-high-severity authorization issue worth prioritizing on exposed/multi-tenant (MSP) deployments, but it requires an existing authenticated account and shows no current exploitation signal, so it is a 'patch on normal cadence, expedite if management plane is internet-exposed' issue rather than an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on an Omada Controller (e.g., a limited MSP tenant or operator user) calls the MSP or OpenAPI certificate-management endpoints, which fail to check administrative authorization. They delete or replace the controller's TLS certificate/private key, breaking HTTPS management access for administrators or substituting an attacker-controlled certificate to position for interception of management sessions. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Improper access control in TP-Link Omada Controller's MSP and OpenAPI certificate/private-key management APIs allows an authenticated user to perform privileged certificate operations - uploading or deleting the controller's TLS certificate or private key - which can disrupt secure management access to the controller. The description states a low-privileged authenticated account is sufficient, although the supplied CVSS 4.0 vector (7.5) specifies PR:H; an independent assessment captures the lower-privilege reading as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, i.e. network-reachable, no user interaction, no confidentiality impact, and high integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis (no KEV listing and no EPSS score were provided), so exploitation requires a valid controller account plus network reachability to the affected MSP or OpenAPI endpoints.
RemediationAI
Apply the vendor fix by upgrading to the patched Omada Controller build referenced in TP-Link's advisory (support document 136188: https://support.omadanetworks.com/us/document/136188/) and on the software download page (https://support.omadanetworks.com/en/download/software/omada-controller/); verify the fixed build in those vendor materials before upgrading, since the provided data does not state an exact patched version number, and do not rely on a version number not listed by the vendor. If an immediate upgrade is not possible, compensate by blocking network access to the Omada Controller management plane from untrusted networks - restrict the MSP/OpenAPI and controller management ports to a hardened administrative VLAN or VPN with firewall allow-lists - and, where the features are unused, disable the MSP and OpenAPI interfaces entirely; the trade-off is loss of MSP multi-tenant management and API-driven automation. Also audit controller accounts and remove or disable low-privileged accounts that do not strictly need management-plane access, and rotate/re-issue the controller TLS certificate and private key after remediation if a certificate upload or deletion is suspected, since the trade-off of rotation is brief management-plane downtime and client re-trust. Monitor for unexpected certificate or key changes in the controller's logs as a detection measure; note that none of these controls fully substitutes for the vendor patch, which remains the primary fix. Patch status reported here is 'Patch available per vendor advisory' only insofar as the referenced vendor documentation and download locations describe the corrected software; the specific patched version was not independently confirmed from the supplied data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-284 (Improper Access Control): the MSP and OpenAPI certificate/private-key management API endpoints on Omada Controller do not enforce an administrative authorization check before executing privileged certificate operations, so a caller who is merely authenticated - potentially with a low-privileged account - can reach functionality reserved for administrators. Note the supplied CVSS 4.0 vector asserts PR:H, while the description and our independent assessment indicate the privilege requirement is effectively lower (PR:L); the discrepancy is material for triage because it changes the population of accounts that can abuse the flaw. The affected surface is the management plane, specifically the certificate lifecycle functions that handle the controller's TLS server certificate and its private key; replacing or deleting those artifacts breaks the trust anchor used for HTTPS management sessions and can lock out administrators, while an attacker-supplied certificate combined with private-key deletion/replacement could enable impersonation or man-in-the-middle of management traffic. No CPE strings were supplied, so exact build-level product mapping must be taken from the referenced vendor material. The 'Authentication Bypass' tag reflects the missing authorization gate rather than an unauthenticated bypass of credentials.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable API abusable by a low-privileged authenticated user (PR:L per description, not PR:H); certificate upload/replace gives I:H and key deletion disrupting management gives A:H; no direct data disclosure so C:N.
Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).
CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630
Lifecycle Timeline
2DescriptionCVE.org
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.
Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
Executive ViewAI
TP-Link Omada Controller, used to manage the organization’s network infrastructure, has a high-severity access-control weakness in its MSP and OpenAPI certificate management interfaces that could allow an authenticated low-privileged user to disrupt secure administrative access. A successful attack could interrupt management connectivity, delay incident response, and force costly certificate recovery across affected controller deployments. With no vendor-released patch identified at time of analysis and no public exploit identified, leadership should prioritize exposure reduction, account governance, and monitoring while awaiting a fix.
No vendor-released patch identified; restrict MSP/OpenAPI endpoints to trusted networks, enforce least privilege and MFA for controller accounts, disable unused API services, monitor and back up TLS certificates/private keys for unauthorized changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB