EAP 225 - Backdored by the update ?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

EAP 225 - Backdored by the update ?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
EAP 225 - Backdored by the update ?
EAP 225 - Backdored by the update ?
2023-05-04 23:26:32 - last edited 2023-05-16 07:14:11
Model: EAP225  
Hardware Version:
Firmware Version: 5.0.9

Hi,

 

Before I start I want to clarify that I'm not a big fan of the cloud and that I'm new to the whole Omada ecosystem and not quite sure how the Cloud components work within its ecosystem. Therefore, I might have some misconceptions for which I would be happy for someone to provide more information and explain how things work.

 

I have bought EAP 225 Access Point to use in the Standalone Mode and disabled all the cloud features in System -> Controller Settings. I have also updated it from a very old firmware to the latest one that is 5.0.9 and noticed some concerning change, not sure if that's how it should be or it's a sign of something more serious.

 

When you navigate to System -> Controller Settings, at the end of the page there is a section called Inform URL\IP Address. That section, before I updated the firmware had  0.0.0.0 filled in but after the update it have changed to the following: 0.0.0.0?dPort=PortNumber&mPort=PortNumber&omadaCId= string of numbers and letters

 

I tried changing the above command and string of switches back to just 0.0.0.0 and saving it but it doesn't do anything. I'm not sure that command should be there especially after I have disabled the Cloud features.

 

I'm worried about the omadaCId switch as the random string of numbers and letters indicate some sort of ID that could point to a specific container\account instance in the cloud that Access Point could try to connect to, at least to my understanding. I tried to search online what omadaCId switch is or what it does but came up empty handed, my guess would be that it stands for Omada Cloud ID or Omada Client ID.

 

Can someone please lend a helping hand ?

Any help is much appreciated.

  0      
  0      
#1
Options
1 Accepted Solution
Re:EAP 225 - Backdored by the update ?-Solution
2023-05-08 08:47:40 - last edited 2023-05-16 07:14:11

Hello @B1G_Criv

 

B1G_Criv wrote

When you navigate to System -> Controller Settings, at the end of the page there is a section called Inform URL\IP Address. That section, before I updated the firmware had  0.0.0.0 filled in but after the update it have changed to the following: 0.0.0.0?dPort=PortNumber&mPort=PortNumber&omadaCId= string of numbers and letters

 

The Controller v5.9 firmware has changed the format of the Inform URL, so the contents have changed since the upgrade.

 

I'm worried about the omadaCId switch as the random string of numbers and letters indicate some sort of ID that could point to a specific container\account instance in the cloud that Access Point could try to connect to, at least to my understanding. I tried to search online what omadaCId switch is or what it does but came up empty handed, my guess would be that it stands for Omada Cloud ID or Omada Client ID.

 

The 0.0.0.0 string is only a hint for the input format of this Inform URL parameter, the 0.0.0.0 address itself is also not valid.

 

In addition, the Inform URL\IP Address is mainly used to tell the AP what the controller's port and address are during the three-layer management, so that the AP can be discovered and managed by the controller, and it has nothing to do with cloud management.

 

If you don't set a specific IP address, no need to worry about it being automatically connected to something else.

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
Recommended Solution
  0  
  0  
#4
Options
3 Reply
Re:EAP 225 - Backdored by the update ?
2023-05-06 03:26:44

  @B1G_Criv 

 

Hi, I don't think it is an issue. It should be a controller ID, but you have disabled it, it won't take any effect I thought.

Just striving to develop myself while helping others.
  0  
  0  
#2
Options
Re:EAP 225 - Backdored by the update ?
2023-05-06 14:46:13

  @Virgo My question is this, why this ID is there in the first place ? If I disable the Cloud features, my Access Point shouldn't have pre-filled a random ID that can link to someone's random Cloud\Controller instance.

 

Can anyone else provide more information ?

  0  
  0  
#3
Options
Re:EAP 225 - Backdored by the update ?-Solution
2023-05-08 08:47:40 - last edited 2023-05-16 07:14:11

Hello @B1G_Criv

 

B1G_Criv wrote

When you navigate to System -> Controller Settings, at the end of the page there is a section called Inform URL\IP Address. That section, before I updated the firmware had  0.0.0.0 filled in but after the update it have changed to the following: 0.0.0.0?dPort=PortNumber&mPort=PortNumber&omadaCId= string of numbers and letters

 

The Controller v5.9 firmware has changed the format of the Inform URL, so the contents have changed since the upgrade.

 

I'm worried about the omadaCId switch as the random string of numbers and letters indicate some sort of ID that could point to a specific container\account instance in the cloud that Access Point could try to connect to, at least to my understanding. I tried to search online what omadaCId switch is or what it does but came up empty handed, my guess would be that it stands for Omada Cloud ID or Omada Client ID.

 

The 0.0.0.0 string is only a hint for the input format of this Inform URL parameter, the 0.0.0.0 address itself is also not valid.

 

In addition, the Inform URL\IP Address is mainly used to tell the AP what the controller's port and address are during the three-layer management, so that the AP can be discovered and managed by the controller, and it has nothing to do with cloud management.

 

If you don't set a specific IP address, no need to worry about it being automatically connected to something else.

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
Recommended Solution
  0  
  0  
#4
Options