CVE-2018-10168: Improper Privilege Management

TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1Windows...

CVE-2018-10166: Cross-Site Request Forgery (CSRF)

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fix...

CVE-2018-10165: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...

PT-2018-9730

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: The issue allows a low-privilege user to make any request as an Administrator due to the lack of privilege control for the usage of the Web...

PT-2018-9727

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: A stored Cross-site scripting XSS issue allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in...

PT-2018-9728

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: The web management interface lacks Anti-CSRF tokens in forms, allowing an attacker to submit authenticated requests when an authenticated us...

PT-2018-9726

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: A stored Cross-site scripting XSS issue allows authenticated attackers to inject arbitrary web script or HTML via the portalPictureUpload...

PT-2018-9729

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: The issue concerns the encryption of the web application backup file, which uses a hard-coded cryptographic key. This allows anyone with...

CVE-2018-10164: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version...