CVE-2021-44032

TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed

published March 7, 2022

CVSS
—
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01792 · 78.2th percentile
Published
2022-03-07T04:06Z
EPSS history
Timeline
  • 07 MAR 04:06Z
    TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed
    cvelistv5