CVE-2018-10168

Опубликовано: 03 мая 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows.

Ссылки

http://www.securityfocus.com/bid/104094
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/104094
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tp-link:eap_controller:2.5.4:*:*:*:*:windows:*:*

cpe:2.3:a:tp-link:eap_controller:2.6.0:*:*:*:*:windows:*:*

EPSS

Процентиль: 69%

0.00588

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-269

Связанные уязвимости

GHSA-cp86-86qv-hq88