Statement on Spring Framework RCE Vulnerability(For Omada Software Controller)
Omada Controller , OC200 , OC300 , Omada Software Controller , Omada Cloud-Based Controller
ربما أدت التحديثات الأخيرة إلى توسيع نطاق الوصول إلى الميزة (الميزات) التي تمت مناقشتها في هذه الأسئلة الشائعة. قم بزيارة صفحة دعم منتجك، وحدد إصدار الأجهزة الصحيح لجهازك وتحقق إما من ملف البيانات الفنية أو قسم البرامج الثابتة للحصول على أحدث التحسينات المضافة إلى منتجك.
TP-Link is aware of the RCE vulnerability CVE-2022-22965 in the Spring Framework. According to the official information, the prerequisites for this vulnerability are as follows.
- Spring Framework: 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, older, unsupported versions are also affected
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- spring-webmvc or spring-webflux dependency
At TP-Link, customer security comes first. TP-Link is closely monitoring and investigating the vulnerability and will keep updating this advisory as more information becomes available.
Potentially Affected TP-Link Products:
Omada Software Controller uses the Spring Framework and supports Java 8 (OpenJDK-8) and above since version 5.0. However, its use of the Spring Framework does not meet the above prerequisites and our attack simulation/vulnerability scan results in a Failure.
Nevertheless, given that the nature of the vulnerability is more general, we recommend that you downgrade to Java 8 (OpenJDK-8) to run the controller. For more detailed guides, please refer to our community.
Both Omada Hardware Controller (OC200 v1/v2, OC300) and Omada Cloud-Based Controller use OpenJDK-8 and are therefore not affected by this vulnerability. TP-Link will update the built-in Spring Framework to fix the vulnerability in subsequent updates.
Unaffected TP-Link products:
All Wi-Fi Router
All Mesh Wi-Fi(Deco)
All Range Extender
All Powerline adapter
All Mobile Wi-Fi products
All SMB Routers, Switch, Omada EAP, and Pharos CPE
All VIGI products
APP: Tether, Deco, Tapo, Kasa, tpMiFi, Omada
Disclaimer
The vulnerability will remain if you do not take all recommended actions. TP-Link cannot bear any responsibility for consequences that could have been avoided by following the recommendations in this statement.
هل تجد هذه الأسئلة مفيدة؟
مشاركتك تساعدنا في تحسين الموقع
ما الأمر الذي لا يرضيك حول هذا المقال؟
- غير راض عن المنتج
- صعب للغاية
- العنوان مشوش
- لا ينطبق على ما أريده
- أجده غامض جدا
- شيئ آخر
يسعدنا تلقي تعليقاتك، يرجى إعلامنا بكيفية تحسين هذا المحتوى.
شكرًا لك
نحن نقدر ملاحظاتك.
انقر هنا للاتصال بالدعم الفني لـ TP-Link.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
Basic Cookies
These cookies are necessary for the website to function and cannot be deactivated in your systems.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Analysis and Marketing Cookies
Analysis cookies enable us to analyze your activities on our website in order to improve and adapt the functionality of our website.
The marketing cookies can be set through our website by our advertising partners in order to create a profile of your interests and to show you relevant advertisements on other websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au