7.5
CVE-2021-44032
- EPSS 0.4%
- Veröffentlicht 10.03.2022 17:44:13
- Zuletzt bearbeitet 21.11.2024 06:30:15
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Omada Software Controller SwPlatformwindows Version < 5.0.15
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.574 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|