PT-2014-4174 · Conceptronic · Conceptronic C54Apm

Publicado 2014-01-10 · Atualizado 2015-08-07 · CVE-2014-1405

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via two methods: (1) the submit-url parameter in a Refresh action to "goform/formWlSiteSurvey" API endpoint, or (2) the wlan-url parameter to "goform/formWlanSetup" API endpoint.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider disabling the Refresh action to "goform/formWlSiteSurvey" and restrict access to the "goform/formWlanSetup" API endpoint to minimize the risk of exploitation. Avoid using the submit-url and wlan-url parameters in the affected API endpoints until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-1405

Produtos afetados

Conceptronic C54Apm

Referências · 4

• http://osvdb.org/101916 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1405 · Nota de Segurança
• http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf · Aviso do Fabricante
• http://osvdb.org/101917 · Nota