vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-84941

Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

MEDIUM
6.9
CVSS Score
Published: September 10, 2026 at 11:35 PM UTC
Updated: September 11, 2026 at 03:40 PM UTC
6 products affected across 1 vendorOmada OC400Omada OC300Omada Software Controller

Using Omada Software Controller (Windows) by TP-Link Systems Inc.?

Get instant alerts when new vulnerabilities affect Omada Software Controller (Windows) - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.9
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Omada OC200· TP-Link
60%
v < 3.3.11 Build 20260711
Affected range stops below 3.3.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Omada OC2000· TP-Link
60%
v < 1.41.11 Build 20260711v < 2.26.11 Build 20260711
Affected range stops below 1.41.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.26.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Omada OC220· TP-Link
60%
v < 1.6.11 Build 20260711v < 2.5.11 Build 20260711
Affected range stops below 1.6.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.5.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Omada OC300· TP-Link
60%
v < 1.35.11 Build 20260711
Affected range stops below 1.35.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Omada OC400· TP-Link
60%
v < 1.13.11 Build 20260711
Affected range stops below 1.13.11 Build 20260711, so it looks safe — our inference, not a vendor statement
Omada Software Controller· TP-Link
60%
v < 6.2.14.11
Affected range stops below 6.2.14.11, so it looks safe — our inference, not a vendor statement

References (5)

Patch
Source: cverecord
https://support.omadanetworks.com/en/download/software/omada-controller
Patch
Source: cverecord
https://support.omadanetworks.com/us/download/software/omada-controller
Patch
Source: cverecord
https://www.omadanetworks.com/en/support/download/
Patch
Source: cverecord
https://www.omadanetworks.com/us/support/download/
Vendor Advisory
Source: cverecord
https://support.omadanetworks.com/en/document/133722/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.9MEDIUMTPLink
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-611

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card