Buletine

Security Advisory on Cross-Site Scripting Vulnerability on Omada Controllers (CVE-2025-9289), and Authentication Weakness on Omada Controllers, Gateways and Access Points (CVE-2025-9290)

Security Advisory: Multiple Vulnerabilities in Omada Controllers (CVE-2025-9520, CVE-2025-9521, CVE-2025-9522)

Security Advisory on Omada Controller Exposure to MongoBleed (CVE-2025-14847)

Security advisory, TP-Link, Omada, CVE-2025-14847, Mongobleed, CVE, security

Security Advisory on Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers and Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception (CVE-2025-9292 and CVE-2025-9293)

Security Advisory on Unauthenticated Denial-of-Service Vulnerability on Omada EAP610 (CVE-2025-7375)

Security Advisory on Input Validation Vulnerability on Multiple Omada Switches (CVE-2026-1668)

Security Advisory: Multiple Vulnerabilities in TP-Link Omada Devices (CVE-2025-9291, CVE-2025-15544, CVE-2025-15627 to CVE-2025-15631)

Security Advisory: Response to Research Concerning TP Link Zero Touch Provisioning (ZTP) Technologies

Security Advisory: Multiple Vulnerabilities in Omada Gateways (CVE-2026-9033, CVE-2026-19586, CVE-2026-19683)

Security Advisory: Unauthenticated Account Information Disclosure in multiple Omada Controllers (CVE-2026-81531)

Security Advisory: Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read (CVE-2026-84941)

Announcement on the Change of Omada Product Firmware Version Numbers

Why did Omada firmware version numbers change? Understand the new numbering rule and the fully adapted controller version to manage devices confidently.

Business Product End-of-Sale (EOS) List

Despre vulnerabilitatea Spring Framework RCE

Statement on Apache Log4j2 Vulnerability

Announcement on Discontinuation of Facebook Wi-Fi

Due to recent changes implemented by Facebook, the Facebook Wi-Fi service will no longer be available after June 12, 2023. Read this announcement to find out the corresponding adjustments made by TP-Link.

Fragment and Forge vulnerabilities(FragAttacks) Statement

GhostDNS Malware Security

Notice of Fraudulent and non-TP-Link Affiliated Websites