AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2018-10166

HIGH · CVSS 8.8 EPSS 0.73%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-05-03 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2018-10166
Severity
HIGH
CVSS
8.8
EPSS
0.73%
Windows

Original NVD Description

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fixed in version 2.6.1_Windows.