CVE-2021-44032
TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.79% probability · 77th percentile
- CISA KEV
- Not listed
- Affected
- tp-link/omada software controller
- Source
- cve@mitre.org
References
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.mdExploit, Third Party Advisory
- https://www.tp-link.com/us/omada-sdn/Vendor Advisory
- https://www.tp-link.com/us/securityVendor Advisory
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.mdExploit, Third Party Advisory
- https://www.tp-link.com/us/omada-sdn/Vendor Advisory
- https://www.tp-link.com/us/securityVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.