vulnerability: Actiontec GT784WN Modem up to NCS01-1.0.12 cross site request forgery : 8/24/2015 3:38:25 AM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

Actiontec GT784WN Modem up to NCS01-1.0.12 cross site request forgery
8/22/2015 7:00:00 PM

General

scipID: 77380
Affected: Actiontec GT784WN Modem up to NCS01-1.0.12
Published: 08/23/2015
Risk: problematic

Created: 08/24/2015
Entry: 66.3% complete

Summary

A vulnerability was found in Actiontec GT784WN Modem up to NCS01-1.0.12. It has been declared as problematic. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a cross site request forgery vulnerability. As an impact it is known to affect integrity. CVE summarizes:

Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.

The weakness was published 08/23/2015. This vulnerability was named CVE-2015-2905. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version NCS01-1.0.13 eliminates this vulnerability.

CVSS

Base Score: 5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N) [?]
Temp Score: 4.4 (CVSS2#E:ND/RL:OF/RC:ND) [?]

CPE

Exploiting

Class: Cross site request forgery
Local: No
Remote: Yes

Availability: No

Countermeasures

Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found

Upgrade: GT784WN Modem NCS01-1.0.13

Timeline

08/23/2015 | Advisory disclosed
08/24/2015 | VulDB entry created
08/24/2015 | VulDB entry updated

Sources

CVE: CVE-2015-2905 (mitre.org) (nvd.nist.org) (cvedetails.com)

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions