PT-2018-6357
CVE-2017-16886
·
تاريخ النشر
2018-01-12
·
تاريخ التحديث
2018-02-02
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
FiberHome Mobile WIFI Device Model LM53Q1 version VH519R05C01S38
Description:
The issue concerns unauthorized access to web services via CSRF, which can lead to changes in the administrator's username or password. This is due to the use of SOAP-based web services for interaction with the portal.
Recommendations:
For FiberHome Mobile WIFI Device Model LM53Q1 version VH519R05C01S38, consider implementing CSRF protection mechanisms to prevent unauthorized access to web services, such as validating request tokens or using same-site cookies to restrict access. As a temporary workaround, restrict access to the web services API to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾