Affected: TP-Link Systems Inc. Omada Software Controller, TP-Link Systems Inc. Omada OC200, OC220, OC300, OC400, TP-Link Systems Inc. Omada cloud controller

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.