CVE-2025-9292
Published: 13 February 2026
Summary
CVE-2025-9292 is a low-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Tp-Link Aginet. Its CVSS base score is 2.0 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2025-9292 is a vulnerability in TP-Link's Omada Cloud Controller service stemming from a permissive web security configuration (CWE-942) that allows cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. The issue affects the web interface of the Omada Cloud Controller, a cloud-based management platform for TP-Link networking devices. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and low attack complexity.
Exploitation requires an existing client-side injection vulnerability in conjunction with legitimate user access to the affected web interface. A remote, unauthenticated attacker could leverage this setup to bypass browser-enforced cross-origin protections, potentially enabling unauthorized disclosure of sensitive information from the targeted domain.
TP-Link has addressed the vulnerability through automatic deployment of updated Omada Cloud Controller service versions, requiring no user action. Detailed mitigation information is available in advisories at https://www.omadanetworks.com/us/support/faq/4969/ and https://www.tp-link.com/us/support/faq/4969/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207523
Vulnerability details
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could…
more
allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables exploitation of a public-facing web application via permissive cross-origin policy bypass (CWE-942), leading to unauthorized data disclosure when combined with client-side injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for web servers to implement strict cross-origin restrictions, directly mitigating the permissive web security configuration.
Requires publicly accessible systems to employ controls limiting access to specific origins, preventing bypass of browser-enforced cross-origin protections.
Enforces approved information flow control policies that restrict cross-origin data access, blocking unauthorized disclosure via permissive configurations.