Omada
Monthly
User enumeration and credential-verification flaws in Omada Controller MSP mode allow an authenticated attacker to validate credentials for other accounts by manipulating the Identifier parameter, potentially leading to unauthorized access to MSP resources or account compromise. Exploitation requires the controller to be running in MSP mode, an existing authenticated session, and knowledge of the target account's Identifier; no public exploit code or active exploitation has been identified at time of analysis. The issue is rated moderate priority due to these prerequisites and the oracle-based nature of the leak, as the endpoint returns distinguishable responses for nonexistent users, invalid passwords, and successful authentication.
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication.
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.
User enumeration and credential-verification flaws in Omada Controller MSP mode allow an authenticated attacker to validate credentials for other accounts by manipulating the Identifier parameter, potentially leading to unauthorized access to MSP resources or account compromise. Exploitation requires the controller to be running in MSP mode, an existing authenticated session, and knowledge of the target account's Identifier; no public exploit code or active exploitation has been identified at time of analysis. The issue is rated moderate priority due to these prerequisites and the oracle-based nature of the leak, as the endpoint returns distinguishable responses for nonexistent users, invalid passwords, and successful authentication.
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication.
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.