CVE-2014-1405

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via two methods: (1) the submit-url parameter in a Refresh action to "goform/formWlSiteSurvey" API endpoint, or (2) the wlan-url parameter to "goform/formWlanSetup" API endpoint.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider disabling the Refresh action to "goform/formWlSiteSurvey" and restrict access to the "goform/formWlanSetup" API endpoint to minimize the risk of exploitation. Avoid using the submit-url and wlan-url parameters in the affected API endpoints until the issue is resolved.