CVE-2018-10167: The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2...

Security readout for executives and security teams

TP-Link EAP Controller and Omada Controller Windows versions 2.5.4 and 2.6.0 used a hard-coded key to encrypt web application backup files. A low-privilege user with access to those backups could decrypt and alter them to gain higher privileges. The source bundle states this is fixed in 2.6.1_Windows. Exposure is most likely in environments still running the affected Windows controller versions or retaining backup files created by them. Risk increases where non-admin users can access controller backups or restore workflows. Treat this as a focused remediation item for any TP-Link controller deployment. It is not documented here as actively exploited, but it can undermine administrative control of wireless infrastructure if affected versions or exposed backups remain in use. Mitigation focus: Upgrade affected Windows controllers to 2.6.1_Windows or later.; Restrict access to controller backup files and restore functions.; Review low-privilege controller accounts and remove unnecessary access..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.