CVE-2018-10166: CSRF

Published May 3, 2018

Updated

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fixed in version 2.6.1Windows.

Affected Software

2 affected components

TP-Link Eap Controller Windows=2.5.4

TP-Link Eap Controller Windows=2.6.0

Event History

May 3, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10166?

CVE-2018-10166 has a medium severity level due to the lack of Anti-CSRF tokens that enables potential authenticated request submission by attackers.

How do I fix CVE-2018-10166?

To fix CVE-2018-10166, update to the latest version of the TP-Link EAP Controller that addresses this vulnerability.

What products are affected by CVE-2018-10166?

The affected products include TP-Link EAP Controller versions 2.5.4 and 2.6.0 for Windows.

What type of attack does CVE-2018-10166 enable?

CVE-2018-10166 enables Cross-Site Request Forgery (CSRF) attacks targeting authenticated users.

What action should I take if I am using an affected version of TP-Link software related to CVE-2018-10166?

If using an affected version, you should upgrade to the patched version of the TP-Link EAP Controller as soon as possible.