TP-Link Eap Controller vulnerabilities

6 CVEs affecting TP-Link Eap Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-5393, published 2018-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-5393, published 2018-09-28. Critical severity, CVSS 9.8. EPSS: 12.9% chance of exploitation in the next 30 days. The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI…
CVE-2018-10168, published 2018-05-03. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an…
CVE-2018-10167, published 2018-05-03. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key…
CVE-2018-10166, published 2018-05-03. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to…
CVE-2018-10164, published 2018-05-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script…
CVE-2018-10165, published 2018-05-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script…