Auth bypass in TP-Link Eap Controller
CVE-2018-5393
The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.129 (96.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.129 · newest: 0.129 · change: 0.000
Affected products
- TP-Link Eap Controller — versions 2.5.3
- TP-Link Eap Controller
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.kb.cert.org/vuls/id/581311 (US Government Resource, Third Party Advisory, third-party-advisory)
- www.securityfocus.com/bid/105402 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-5393?
- CVE-2018-5393 is a critical-severity vulnerability in TP-Link Eap Controller, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2018-09-28.
- How severe is CVE-2018-5393?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-5393 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.