Affected: TP-Link System Inc. Omada Software Controller, TP-Link Systems Inc. OC200 V1, TP Link Systems Inc. OC200 v2, TP-Link Systems Inc OC200 v3, TP-Link Systems Inc. OC220 v1, TP-Link Systems Inc OC220 v2, TP-Link Systems Inc. OC300 v1, TP-Link Systems Inc. OC400 v1

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.

Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.