CVE-2026-107795
CVE-2026-107795 · Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
CVSS 7.5 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
omada software controller
- Versiones
- ≥ 0, < 6.3.0.45: Afectada (custom)
Actualiza a 6.3.0.45