Omada Controller EUVD-2026-101709

Requires three concrete prerequisites: (1) the Omada Controller must be running in MSP mode, where the vulnerable user-confirmation endpoint is exposed; (2) the attacker must already hold a valid authenticated session on that controller (the CVSS PR:H claims high privilege, though the description says only 'an authenticated user' - this limit should be confirmed with the vendor); and (3) the attacker must know or guess the target account's Identifier parameter to substitute it. Limiting factors that reduce realistic risk: MSP mode is a specific deployment that standalone/controller-only installs do not run, authentication is mandatory (no unauthenticated path), and the endpoint yields an oracle rather than direct code execution - full account compromise still depends on acting on the leaked credential/enumeration signal.

This is a moderate-priority issue rather than a drop-everything emergency, and the signals are partially conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC:H/VI:H/VA:H) scores 7.5 and models an authenticated, high-privilege attacker on a network-reachable interface with a specific attack requirement (AT:P) - consistent with the need for MSP mode and a caller-controlled Identifier. However, the description characterizes the actor merely as 'an authenticated user,' which implies a low-privilege account, not the PR:H the vendor vector asserts - this PR:H vs. low-privilege-description discrepancy should be verified with TP-Link/Omada, because if any authenticated tenant user can exercise the oracle (PR:L), real-world risk is meaningfully higher than the 7.5 suggests. No EPSS score was provided, no POC was supplied, and the CVE is not on CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical impact is a credential-validation/user-enumeration oracle (CWE-639, insecure direct reference to another account) that can escalate to takeover of targeted MSP accounts; the gating factors (MSP mode must be enabled, attacker must already be authenticated) keep this from being a wormable, unauthenticated internet threat. Net: a genuine authorization/IDOR weakness worth patching promptly on MSP deployments, but not a mass-exploitation candidate on the available signals.

An attacker who already holds an authenticated account on an Omada Controller running in MSP mode calls the user-confirmation endpoint and substitutes another account's Identifier, using the endpoint's distinct responses (nonexistent user vs. invalid password vs. success) as a credential-testing and enumeration oracle. With AV:N and AC:L the requests are low-effort once authenticated, letting the attacker enumerate valid MSP users and brute-force or confirm credentials to take over a targeted account. No public exploit code is known at time of analysis, so this would require custom tooling.