CVE-2025-9292
Published: 13 February 2026
Summary
CVE-2025-9292 is a high-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Tp-Link Aginet. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables exploitation of a public-facing web application via permissive cross-origin policy bypass (CWE-942), leading to unauthorized data disclosure when combined with client-side injection.
NVD Description
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could…
more
allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
Deeper analysisAI
CVE-2025-9292 is a vulnerability in TP-Link's Omada Cloud Controller service stemming from a permissive web security configuration (CWE-942) that allows cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. The issue affects the web interface of the Omada Cloud Controller, a cloud-based management platform for TP-Link networking devices. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and low attack complexity.
Exploitation requires an existing client-side injection vulnerability in conjunction with legitimate user access to the affected web interface. A remote, unauthenticated attacker could leverage this setup to bypass browser-enforced cross-origin protections, potentially enabling unauthorized disclosure of sensitive information from the targeted domain.
TP-Link has addressed the vulnerability through automatic deployment of updated Omada Cloud Controller service versions, requiring no user action. Detailed mitigation information is available in advisories at https://www.omadanetworks.com/us/support/faq/4969/ and https://www.tp-link.com/us/support/faq/4969/.
Details
- CWE(s)