CVE-2018-10164: Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions...

Security readout for executives and security teams

This CVE is a stored XSS flaw in TP-Link EAP Controller and Omada Controller for Windows. An authenticated attacker could store malicious web content through portal picture upload functionality, potentially affecting later users of the controller interface. The source states this is fixed in 2.6.1_Windows. Likely exposure is limited to environments running the named Windows controller versions, especially where authenticated users can access portal picture upload or the management interface. Treat as a near-term remediation item where these TP-Link controllers exist. It is not cited as actively exploited, but stored XSS in a management console can support account abuse or administrative session risk. Mitigation focus: Upgrade affected Windows controllers to 2.6.1_Windows or later vendor-supported guidance.; Restrict controller management access to trusted administrators and networks.; Review authenticated users allowed to manage portal configuration or uploads..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.