Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84941— Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

Quick assessment

Affected
TP-Link Systems Inc. Omada Software Controller (Windows)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Omada Controller 的 SAML 单点登录（SSO）功能中存在一个信息泄露漏洞。该漏洞是由于对用户提供的 SAML 元数据校验不足所致，使得拥有 SAML 配置权限的已认证用户可以访问敏感信息。若该漏洞被成功利用，可能导致敏感信息被未授权泄露。

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84941

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
Source: CVE Program / CVE List V5
Vulnerability Description
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Omada Software Controller (Windows) 0 ~ 6.2.14.11 -
TP-Link Systems Inc. Omada Software Controller (Linux) 0 ~ 6.2.14.11 -
TP-Link Systems Inc. OC2000 v1 0 ~ 1.41.11 Build 20260711 -
TP-Link Systems Inc. OC2000 v2 0 ~ 2.26.11 Build 20260711 -
TP-Link Systems Inc. OC200 v3 0 ~ 3.3.11 Build 20260711 -
TP-Link Systems Inc. OC220 v1 0 ~ 1.6.11 Build 20260711 -
TP-Link Systems Inc. OC220 v2 0 ~ 2.5.11 Build 20260711 -
TP-Link Systems Inc. OC300 v1 0 ~ 1.35.11 Build 20260711 -
TP-Link Systems Inc. OC400 v1 0 ~ 1.13.11 Build 20260711 -

II. Public POCs for CVE-2026-84941

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84941

请登录查看更多情报信息。

Vendor Pages for CVE-2026-84941 (1)

Other References for CVE-2026-84941 (3)

Same Patch Batch · TP-Link Systems Inc. · 2026-09-10 · 4 CVEs total

CVE-2026-17176 7.7 HIGH OS command injection Vulnerability in Deco BE11000
CVE-2026-76653 5.3 MEDIUM Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR6
CVE-2026-76652 4.8 MEDIUM Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL

IV. Related Vulnerabilities

Same vendor: TP-Link Systems Inc.
Same weakness: CWE-611

V. Comments for CVE-2026-84941

No comments yet

Leave a comment