PT-2022-8675

CVE-2020-23582

Published

2022-11-21

Updated

2022-11-23

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions optilink OP-XT71000N version: V2.2

Description A vulnerability in the "/admin/wlmultipleap.asp" API endpoint of optilink OP-XT71000N could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.

Recommendations For optilink OP-XT71000N version: V2.2, as a temporary workaround, consider restricting access to the "/admin/wlmultipleap.asp" API endpoint until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Disguised_Noob

Huzaifa Hussain

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers