TP-Link OC300 Firmware vulnerabilities

2 CVEs affecting TP-Link OC300 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9290, published 2026-01-23.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-9290, published 2026-01-23. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced…
• CVE-2025-9289, published 2026-01-22. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network…