CVE-2025-9520 HIGH

CVE-2025-9520: IDOR Leading to Owner Account Hijacking in Omada Controller

Vendor Tp-Link Systems Inc.

Product Omada Controller

Weakness CWE-639 · IDOR

Published January 26, 2026

Last update January 26, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L

What the vulnerability does

01Description

An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.

Key dates

02Disclosure timeline

January 26, 2026 CVE published

January 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-9520 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2026-0909 WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter CVE-2026-25564 WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation CVE-2021-24892 Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR CVE-2025-31950 Growatt Cloud portal Authorization Bypass Through User-Controlled Key CVE-2026-32867 OPEXUS eComplaint unauthenticated file upload