Provenance Record

Well-structured News piece (951 words, within the 400-1200 range) with clear Overview, background, What We Know / What We Don't Know, and Analysis sections. Technical material (ZTP, CVE chaining, attack scenarios) is explained accessibly without oversimplifying.

Read all three snapshots in full: source-0.html.gz (SecurityWeek, status 200, direct fetch), source-1.html.gz (BleepingComputer, status 200 via Archive.org fallback because the live fetch was blocked — flagged as info-severity by the automated script, not a concern since the archived page is a faithful capture of the live article), and source-2.html.gz (NVD CVE-2025-9289 detail page, status 200, direct fetch). Every factual claim in the article traces to one of these three snapshots: the 15-vulnerability count, the CVE list (CVE-2025-9289 through -9293, CVE-2025-15544, CVE-2025-15627 through -15631), the four unassigned low-severity findings, the two prior RCE CVEs (CVE-2025-7850/7851), the >1,800 internet-exposed controllers figure, the cleartext-username/unsalted-MD5-hash detail, and the cross-product weakness spillover to VIGI/Festa/Tapo/Kasa are all present verbatim or as accurate paraphrase in the SecurityWeek and BleepingComputer snapshots. CVE-2025-9289's classification as an XSS flaw from improper input sanitization in Omada Controllers is confirmed word-for-word against the NVD description field. The direct Forescout quote ('Combined with two previously disclosed CVEs...') matches the BleepingComputer snapshot exactly. The 'researchers noted' line about root-level command execution is verbatim text lifted from SecurityWeek's reported-speech sentence; SecurityWeek did not itself set it off in quotation marks, so the article's choice to present it as a quoted line is a minor stylistic liberty, but the wording is accurate and not fabricated, so it does not rise to a corrections-worthy misattribution. No suspicious_patterns were flagged in the manifest for any of the three sources.

No hallucinated facts or figures found. All specifics (CVE IDs, vulnerability counts, exposed-instance count, affected product lines) match the source snapshots.

Clean, well-sourced submission. All three cited sources (SecurityWeek, BleepingComputer, NVD) are on the allowlist and were read in full; every claim in the headline, summary, and body traces to them. Approved without corrections.