CVE-2018-5393
📋 TL;DR
CVE-2018-5393 is an authentication bypass vulnerability in TP-LINK EAP Controller's Java RMI service that allows remote attackers to execute arbitrary code without credentials. This affects organizations using TP-LINK wireless access point management software version 2.5.3 and earlier. Attackers can gain complete control of the controller server through deserialization attacks.
💻 Affected Systems
- TP-LINK EAP Controller
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the EAP controller server leading to full network access, credential theft, installation of persistent backdoors, and compromise of all managed wireless access points.
Likely Case
Remote code execution on the controller server allowing attackers to pivot to internal networks, intercept wireless traffic, and disrupt wireless services.
If Mitigated
Limited impact if controller is isolated in a secure network segment with strict firewall rules and network monitoring.
🎯 Exploit Status
Exploitation is straightforward using standard Java deserialization attack tools against the exposed RMI interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.5.4 and later
Vendor Advisory: https://www.tp-link.com/us/support/download/eap-controller/
Restart Required: Yes
Instructions:
1. Download EAP Controller version 2.5.4 or later from TP-LINK website. 2. Backup current configuration. 3. Stop the EAP Controller service. 4. Install the updated version. 5. Restore configuration if needed. 6. Restart the service.
🔧 Temporary Workarounds
Network Segmentation
allIsolate EAP Controller to management VLAN with strict firewall rules
Firewall Block RMI Port
linuxBlock access to Java RMI port (default 1099) from untrusted networks
iptables -A INPUT -p tcp --dport 1099 -j DROP
🧯 If You Can't Patch
- Immediately isolate the EAP controller server from all untrusted networks using firewall rules
- Implement network monitoring for RMI traffic and Java deserialization attempts on port 1099
🔍 How to Verify
Check if Vulnerable:
Check EAP Controller version in web interface or via 'java -version' if running Java service directly. Versions 2.5.3 and earlier are vulnerable.Check Version:
Check web interface at http://controller-ip:8088 or examine installed program version in Windows/LinuxVerify Fix Applied:
Verify version is 2.5.4 or later in web interface and test that RMI service requires authentication.📡 Detection & Monitoring
Log Indicators:
- Java RMI connection attempts
- Java deserialization errors in logs
- Unexpected Java class loading
Network Indicators:
- TCP connections to port 1099 from unexpected sources
- Java RMI protocol traffic patterns
SIEM Query:
source_port=1099 OR (event_description CONTAINS 'RMI' AND event_description CONTAINS 'deserialization')