CVE-2018-10168: High severity tp-link eap controller vulnerability

Published May 3, 2018

Updated

TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1Windows.

Affected Software

2 affected components

TP-Link Eap Controller Windows=2.5.4

TP-Link Eap Controller Windows=2.6.0

Event History

May 3, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10168?

CVE-2018-10168 is considered a medium severity vulnerability due to improper access control in the Web API.

How do I fix CVE-2018-10168?

To fix CVE-2018-10168, upgrade to version 2.6.1_Windows or later of the TP-Link EAP Controller.

What types of users are affected by CVE-2018-10168?

CVE-2018-10168 affects low-privilege users who can exploit the vulnerability to perform administrative actions.

Which versions of TP-Link EAP Controller are vulnerable to CVE-2018-10168?

Versions 2.5.4_Windows and 2.6.0_Windows of the TP-Link EAP Controller are vulnerable to CVE-2018-10168.

What impact does CVE-2018-10168 have on my system?

CVE-2018-10168 allows unauthorized actions by low-privileged users, potentially compromising the integrity of the EAP Controller.