Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Omada Software Controller (Windows)
Vendor
TP-Link Systems Inc.
Product
Omada Software Controller (Windows)
Platforms
Omada Controller
Default status
unaffected
Omada Software Controller (Windows) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
6.2.14.11
Unavailable
None listed
Omada Software Controller (Linux)
Vendor
TP-Link Systems Inc.
Product
Omada Software Controller (Linux)
Platforms
Omada Controller
Default status
unaffected
Omada Software Controller (Linux) · Scoped product and version facts