Auth bypass in TP-Link Eap Controller
CVE-2018-5393
The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode.
Vulnerability class: Broken Authentication
EPSS: 0.129 (95.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tp-link Eap Controller — versions 2.5.3
- Tp-link Eap_controller
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cret@cert.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-5393?
- CVE-2018-5393 is a critical-severity vulnerability in TP-Link Eap Controller, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2018-09-28.
- How severe is CVE-2018-5393?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-5393 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.