Description (CNA)
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TP-Link Systems Inc. / Omada Software Controller | affected 0 before 6.3.0.45 |
CWE
CWE-862, CWE-284
References
- https://support.omadanetworks.com/en/download/software/omada-controller/
- https://support.omadanetworks.com/us/download/software/omada-controller/
- https://support.omadanetworks.com/us/document/136188/
ADP enrichment
No English description supplied.
No references supplied.