TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows.

TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows.

TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows. TP-Link EAP Controller and Omada Controller Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkEAPController and OmadaController are software used by TP-LINK to remotely control wireless AP access point devices. This vulnerability stems from the program's failure to control the use of WebAPI. An attacker could exploit the vulnerability to send a request as an administrator. TP-Link EAP Controller and Omada Controller are prone to the following security vulnerabilities: 1. A privilege-escalation vulnerability 2. A hard-coded cryptographic key vulnerability 3. A cross-site request-forgery vulnerability 4. Multiple HTML-injection vulnerability An attacker may leverage these issues to gain elevated privileges, perform unauthorized actions and gain access to the affected application, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. **Advisory Information**

Title: TP-Link EAP Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0001 Advisory URL: http://www.coresecurity.com/advisories/tp-link-eap-con…