Authentication flaw

2022-03-1017:44:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.3%

JSON

TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded “no authentication” method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.

CPENameOperatorVersion
omada_software_controllerlt5.0.15

CPE	Name	Operator	Version
	omada_software_controller	lt	5.0.15

References

github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.md

www.tp-link.com/us/omada-sdn/

www.tp-link.com/us/security