The Omada Controller’s MSP and OpenAPI certificate management functions do not properly enforce administrative authorization. A user who is authenticated but holds only low privileges can upload or delete the controller’s TLS certificate or private key. This lets an attacker disrupt or tamper with secure management access, potentially leading to loss of confidentiality and integrity of management traffic.

TP‑Link Systems Inc. – Omada Software Controller. Specific affected versions are not listed, so any installation using the current controller software is at risk unless a patch has been applied.

The CVSS score of 7.5 indicates high severity. An EPSS score is not available, so exploitation probability is uncertain, and the vulnerability is not in the CISA KEV catalog. The flaw is an authorization bypass in the controller’s certificate management APIs, which are reachable over the network. An attacker only needs to be authenticated to the controller—credentials can be obtained via legitimate user login—to perform privileged certificate operations, potentially breaking secure management sessions.