High-Severity IDOR Flaw Lets Admins Hijack TP-Link Omada Owner Accounts

TP-Link issued an advisory detailing three vulnerabilities in Omada Controller: CVE-2025-9520 (IDOR, CVSS 8.3) which can allow an Administrator to take over the Owner account and gain full control of the management plane; CVE-2025-9521 (Password Confirmation Bypass, Low) that lets an attacker with a valid session change passwords without secondary confirmation; and CVE-2025-9522 (Blind SSRF, Medium) in webhook functionality that may permit internal service enumeration. Administrators should check affected versions and apply updates immediately.