CVE-2025-9520 IDOR Leading to Owner Account Hijacking in Omada Controller
An IDOR vulnerability allows administrators to hijack the Owner account in TP-Link Omada Controllers, requiring a patch to prevent unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9520?
CVE-2025-9520 is a high-severity missing authorization vulnerability in TP-Link Systems Inc. Omada Controller, published on 26 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.
Weakness: CWE-639
Which versions are affected by CVE-2025-9520?
It affects 1 product.
Products include Tp-Link Omada Controller.
How do I fix CVE-2025-9520?
No fix has been published for CVE-2025-9520 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-9520 being exploited?
There is no known exploitation of CVE-2025-9520 in the wild and no public exploit code.
Other vulnerabilities in TP-Link Systems Inc. Omada Controller
Sources
Also known as GHSA-q7gm-8832-99rj.