Security Advisory catalog CVE-2026-81531
cve-program · CVE-2026-81531 Published
An information
disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization
remains accessible after completion and may disclose account-related
information to unauthenticated remote users.
Successful
exploitation may allow an attacker to remote query the affected endpoint that
may facilitate user enumeration and subsequent attacks targeting administrative
accounts.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-81531 Published Omada Software Controller Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link System Inc.",
"product": "Omada Software Controller",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.3.0.45",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC200 V1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC200 V1",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V1_1.42.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC200 v2 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP Link Systems Inc.",
"product": "OC200 v2",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V2_2.27.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC200 v3 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc",
"product": "OC200 v3",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V3_3.4.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC220 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC220 v1",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V1_1.7.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC220 v2 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc",
"product": "OC220 v2",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V2_2.6.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC300 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC300 v1",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V1_1.36.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC400 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC400 v1",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "(UN)_V1_1.14.10 Build 20260825",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Original source record · Cite this exact observation · Complete original publisher JSON