CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Privilege Management
Summary: tp-link eap controller and omada controller versions 2.5.4_windows/2.6.0_windows do not control privileges for usage of the web api, allowing a low-privilege user to make any request as an administrator. this is fixed in version 2.6.1_windows.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-05-03
Last Modified Date: 2019-10-03