PT-2007-5960 · Buffalo · Buffalo Airstation Whr-G54S

Publicado 2007-09-11 · Atualizado 2018-10-15 · CVE-2007-4822

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Buffalo AirStation WHR-G54S version 1.20

Description: A cross-site request forgery (CSRF) issue exists in the device management interface, allowing remote attackers to make configuration changes as an administrator. This can be achieved via HTTP requests to certain HTML pages, specifically by accessing pages such as "ap.html" and "filter ip.html" with an "inp req" parameter to "cgi-bin/cgi".

Recommendations: For Buffalo AirStation WHR-G54S version 1.20, consider disabling access to the device management interface until a patch is available. Restrict access to the "cgi-bin/cgi" endpoint to minimize the risk of exploitation. Avoid using the "res" parameter in HTTP requests to certain HTML pages until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-4822

Produtos afetados

Buffalo Airstation Whr-G54S

Referências · 10

• 🔥 http://louhi.fi/advisory/buffalo_070907.txt · Exploit
• 🔥 http://securityfocus.com/bid/25588 · Exploit
• http://securityfocus.com/archive/1/478795/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4822 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4822 · Nota
• http://secunia.com/advisories/26712 · Nota
• http://osvdb.org/37665 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36492 · Nota
• http://securityfocus.com/archive/1/478801/100/0/threaded · Nota
• http://securityreason.com/securityalert/3117 · Nota