Description
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Published: 2026-09-10
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

An authenticated user with SAML configuration privileges can inject XML external entities validate the supplied metadata, allowing the extraction of local files. This results in the attacker reading sensitive files on the controller host, exposing configuration data or credentials.

Affected Systems

TP‑Link Systems Inc. Omada Controller software for Linux and Windows, and various OC firmware revisions – OC200 v3, OC2000 v1, OC2000 v2, OC220 v1, OC220 v2, OC300 v1, and OC400 v1.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9. No EPSS value is published, and the flaw is not listed in CISA's KEV catalog. Exploitation requires an authenticated user with SAML configuration rights; thus the attack vector is internal, following the likelihood that such privileges exist within an organization. Given the documented local file read capability, the impact is moderate but could allow discovery of private data.

Generated by OpenCVE AI on September 11, 2026 at 03:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Omada Controller firmware or software release that fixes the XML External Entity (XXE) vulnerability identified as CWE‑611 in SAML metadata parsing.
  • Restrict SAML configuration permissions to trusted administrators only, addressing the inadequate input validation weakness (CWE‑611).
  • If SAML Single Sign-On is not required, disable the feature to eliminate the XXE vector and reduce exposure.

Generated by OpenCVE AI on September 11, 2026 at 03:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Title Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
Weaknesses CWE-611
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-09-11T13:16:12.359Z

Reserved: 2026-09-02T16:45:11.015Z

Link: CVE-2026-84941

cve-icon Vulnrichment

Updated: 2026-09-11T13:16:06.612Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T00:19:57.633

Modified: 2026-09-11T15:21:12.850

Link: CVE-2026-84941

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T04:00:08Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference