PT-2007-5570 · 2Wire · 2Wire 1701Hg+2

Publicado 2007-08-17 · Atualizado 2018-10-15 · CVE-2007-4389

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions 2wire 1701HG version 3.17.5 2wire 1800HW version 3.7.1 2wire 2071 Gateway version 5.29.51

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to create DNS mappings as administrators and conduct DNS poisoning attacks. This is achieved via the NAME and ADDR parameters in the /xslt endpoint.

Recommendations For 2wire 1701HG version 3.17.5, update the software to a version that addresses this issue. For 2wire 1800HW version 3.7.1, update the software to a version that addresses this issue. For 2wire 2071 Gateway version 5.29.51, update the software to a version that addresses this issue. As a temporary workaround, consider restricting access to the /xslt endpoint to minimize the risk of exploitation. Avoid using the NAME and ADDR parameters in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-4389

Produtos afetados

2Wire 1701Hg

2Wire 1800Hw

2Wire 2071 Gateway

Referências · 7

• 🔥 https://exploit-db.com/exploits/31013 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36044 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4389 · Nota de Segurança
• http://securityreason.com/securityalert/3026 · Nota
• http://hakim.ws/2wire/demodns.html · Nota
• http://securityfocus.com/bid/27246 · Nota
• http://securityfocus.com/archive/1/476595/100/0/threaded · Nota