CVE-2026-84941

Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

View on CVE.org
Published Sep 10, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

Analysis

AI-generated

Technical impact

An authenticated user with SAML configuration privileges can inject XML external entities validate the supplied metadata, allowing the extraction of local files. This results in the attacker reading sensitive files on the controller host, exposing configuration data or credentials.

Affected Systems

TP‑Link Systems Inc. Omada Controller software for Linux and Windows, and various OC firmware revisions – OC200 v3, OC2000 v1, OC2000 v2, OC220 v1, OC220 v2, OC300 v1, and OC400 v1.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9. No EPSS value is published, and the flaw is not listed in CISA's KEV catalog. Exploitation requires an authenticated user with SAML configuration rights; thus the attack vector is internal, following the likelihood that such privileges exist within an organization. Given the documented local file read capability, the impact is moderate but could allow discovery of private data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Omada Controller firmware or software release that fixes the XML External Entity (XXE) vulnerability identified as CWE‑611 in SAML metadata parsing.
  • Restrict SAML configuration permissions to trusted administrators only, addressing the inadequate input validation weakness (CWE‑611).
  • If SAML Single Sign-On is not required, disable the feature to eliminate the XXE vector and reduce exposure.

Generated by OpenCVE AI on September 11, 2026 at 03:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tp-link
Tp-link oc2000 V1
Tp-link oc2000 V2
Tp-link oc200 V3
Tp-link oc220 V1
Tp-link oc220 V2
Tp-link oc300 V1
Tp-link oc400 V1
Tp-link omada Software Controller
Vendors & Products Tp-link
Tp-link oc2000 V1
Tp-link oc2000 V2
Tp-link oc200 V3
Tp-link oc220 V1
Tp-link oc220 V2
Tp-link oc300 V1
Tp-link oc400 V1
Tp-link omada Software Controller
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Title Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
Weaknesses CWE-611
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference

Sources

Status
PUBLISHED
Assigner
TPLink
Published
Updated
Sep 11, 2026, 1:16 PM
Reserved
Sep 2, 2026, 4:45 PM

View source JSON

Updated
Sep 11, 2026, 1:16 PM

JSON

Status
Deferred
Published
Sep 11, 2026, 12:19 AM
Modified
Sep 11, 2026, 3:21 PM

View source JSON

No data.

Updated
Sep 13, 2026, 7:57 PM

JSON