CVE-2018-5393: TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authentication
The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5393?
CVE-2018-5393 is classified as a critical vulnerability due to the lack of authentication in the RMI service.
How do I fix CVE-2018-5393?
To fix CVE-2018-5393, upgrade the TP-LINK EAP Controller software to version 2.6.0 or later, which includes patches for this vulnerability.
What systems are affected by CVE-2018-5393?
CVE-2018-5393 affects all versions of TP-LINK EAP Controller software up to and including 2.5.3.
What are the risks associated with CVE-2018-5393?
The risks associated with CVE-2018-5393 include unauthorized access to the EAP Controller and potential control over connected access points.
Is authentication required for accessing the RMI service in CVE-2018-5393?
No, the RMI service in CVE-2018-5393 does not require authentication, making it vulnerable to exploitation.