CVE-2018-10165: Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions...

Security readout for executives and security teams

An authenticated user could store malicious script in a local username inside TP-Link EAP/Omada Controller for Windows. When another administrator views that data, the script could run in their browser. The public record says versions 2.5.4_Windows and 2.6.0_Windows are affected and 2.6.1_Windows fixes it. Exposure is most likely where affected Windows controller versions remain deployed and reachable by administrators or authenticated users who can create local users. Internet exposure is not stated in the sources, so assess management interface accessibility locally. Treat as a controlled but real management-plane risk. Prioritize remediation if affected controllers administer business wireless infrastructure or are accessible beyond a small trusted admin group. Mitigation focus: Upgrade affected Windows controllers to 2.6.1_Windows or later.; Restrict controller access to trusted administration networks and accounts.; Review vendor guidance before applying compensating controls..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.