CVE-2018-10166: The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6....

Security readout for executives and security teams

This flaw affects TP-Link EAP Controller and Omada Controller Windows versions 2.5.4 and 2.6.0. Their web management forms lacked anti-CSRF tokens, so an attacker could cause a logged-in administrator to submit unwanted management requests by visiting an attacker-controlled site. The source says this is fixed in 2.6.1_Windows. Exposure is likely limited to organizations running the named Windows controller versions, especially where administrators access the controller through a browser and remain authenticated. Internet exposure is not stated in the sources, so assess local deployment and management network reachability. Treat as a targeted administrative-control risk, not a broad unauthenticated takeover based on current evidence. Prioritize upgrading if the controller manages production wireless infrastructure or is reachable from broad internal networks. Mitigation focus: Upgrade affected Windows controllers to 2.6.1_Windows or later.; Restrict controller web access to trusted admin networks.; Review TP-Link/Core Security guidance for related controller issues..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.