CVE-2018-10167

CVE-2018-10167 describes a critical vulnerability in TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows and 2.6.0_Windows, where web application backup files are encrypted using a hard-coded cryptographic key. This allows a low-privilege attacker to decrypt and modify these backup files, potentially leading to privilege escalation. The vulnerability carries a CVSS score of 7.5 (HIGH) due to its network-based attack vector, high impact on confidentiality, integrity, and availability, despite requiring high attack complexity and low privileges. There is no evidence of active exploitation, publicly available exploit code in Metasploit or ExploitDB, or significant community discussion or media coverage.