CVE-2025-9292
CWE-942Published: February 13, 2026· Updated: Feb 13, 2026
Official Description
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
Technical Analysis
CVE-2025-9292 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-942)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-9292 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts