PT-2017-13334

CVE-2017-14267

·

Publicado

2017-09-11

·

Atualizado

2017-09-15

Descrição por

CVSS 3.1
8.8
Alta
MétricasAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31
Description The issue is related to Cross-Site Request Forgery (CSRF) and is associated with several API endpoints, including "goform/AddNewProfile", "goform/setWanDisconnect", "goform/setSMSAutoRedirectSetting", "goform/setReset", and "goform/uploadBackupSettings".
Recommendations For versions before EE60 00 05.00 31, update to version EE60 00 05.00 31 or later to resolve the issue. As a temporary workaround, consider restricting access to the mentioned API endpoints until a patch is available.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-352: Cross-Site Request Forgery (CSRF)
Identificadores relacionados
CVE-2017-14267
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com