{"id":"CVE-2026-81531","title":"An information\ndisclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization\nremains accessible after completion and may disclose account-related\ninformation to unauthenticated …","summary":"An information\ndisclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization\nremains accessible after completion and may disclose account-related\ninformation to unauthenticated …","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-200"],"vendor":"TP-Link System Inc.","product":"Omada Software Controller","affected":["omada_software_controller < 6.3.0.45","oc200_v1 < (UN)_V1_1.42.10 Build 20260825","oc200_v2 < (UN)_V2_2.27.10 Build 20260825","oc200_v3 < (UN)_V3_3.4.10 Build 20260825","oc220_v1 < (UN)_V1_1.7.10 Build 20260825","oc220_v2 < (UN)_V2_2.6.10 Build 20260825","oc300_v1 < (UN)_V1_1.36.10 Build 20260825","oc400_v1 < (UN)_V1_1.14.10 Build 20260825"],"published":"2026-09-08","updated":"2026-09-21","sourceUpdated":"2026-09-21T18:17:10.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81531","references":[{"url":"https://support.omadanetworks.com/en/download/software/omada-controller/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/document/133567/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/download/software/omada-controller/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T17:21:39.911958Z"},"cvssSource":"cna","epss":0.00383,"epssPercentile":0.32244,"ingestedAt":"2026-09-08T19:08:49.600Z","slug":"CVE-2026-81531","body":"## Overview\n\nAn information\ndisclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization\nremains accessible after completion and may disclose account-related\ninformation to unauthenticated remote users. \n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to remote query the affected endpoint that\nmay facilitate user enumeration and subsequent attacks targeting administrative\naccounts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}