CVE-2026-107795
Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
| CWE | CWE-862 CWE-284 |
| Vendor | tp-link systems inc. |
| Product | omada software controller |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for tp-link systems inc. omada software controller
Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. omada software controller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TP-Link Systems Inc. / Omada Software Controller
0 < 6.3.0.45
References
Credits
eslam moneer (tohtmosiii)