CVE-2021-44032

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.mdExploit, Third Party Advisory
https://www.tp-link.com/us/omada-sdn/Vendor Advisory
https://www.tp-link.com/us/securityVendor Advisory
https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.mdExploit, Third Party Advisory
https://www.tp-link.com/us/omada-sdn/Vendor Advisory
https://www.tp-link.com/us/securityVendor Advisory

Timeline

Published: Mar 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-440336.8In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.CVE-2021-440357.8Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious f CVE-2021-440368.8Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.CVE-2021-440377.5Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.CVE-2021-440387.8An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the n CVE-2021-44044.3The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This CVE-2021-440407.5Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This i CVE-2021-440419.8UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI h CVE-2021-440429.8An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uip CVE-2021-440435.4An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading CVE-2021-440447.8An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific iss CVE-2021-440457.8An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific iss