CVE-2018-10164: XSS
Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version 2.6.1Windows.
Affected Software
Event History
Frequently Asked Questions
What is the CVE-2018-10164 vulnerability?
CVE-2018-10164 is a Stored Cross-site Scripting (XSS) vulnerability in TP-Link EAP Controller and Omada Controller versions 2.5.4 and 2.6.0 that allows authenticated attackers to inject arbitrary web scripts or HTML.
What are the affected versions in CVE-2018-10164?
The affected versions for CVE-2018-10164 are TP-Link EAP Controller 2.5.4 and 2.6.0 for Windows.
How do I fix CVE-2018-10164?
To fix CVE-2018-10164, upgrade to TP-Link EAP Controller version 2.6.1 or later.
What is the impact of CVE-2018-10164?
The impact of CVE-2018-10164 allows an attacker to execute arbitrary scripts in the context of the user’s browser through the compromised TP-Link EAP Controller.
Is authentication required to exploit CVE-2018-10164?
Yes, exploitation of CVE-2018-10164 requires the attacker to be authenticated to the TP-Link EAP Controller.