PT-2014-5713 · Zyxel · Zyxel P-660Hw-T1

Mustafa Altinkaynak · Publicado 2014-06-16 · Atualizado 2014-07-17 · CVE-2014-4162

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zyxel P-660HW-T1 version v3

Description The issue affects the Zyxel P-660HW-T1 wireless router, where multiple cross-site request forgery (CSRF) vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in question are those that change the wifi password or the SSID, which can be executed via a request to "Forms/WLAN General 1".

Recommendations For Zyxel P-660HW-T1 version v3, consider disabling access to the "Forms/WLAN General 1" endpoint until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the wifi password and SSID change functionalities to minimize the risk of unauthorized changes.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-4162

Produtos afetados

Zyxel P-660Hw-T1

Referências · 6

• 🔥 https://exploit-db.com/exploits/33518 · Exploit
• 🔥 http://exploit-db.com/exploits/33518 · Exploit
• http://osvdb.org/show/osvdb/107449 · Nota
• http://packetstormsecurity.com/files/126812/Zyxel-P-660HW-T1-Cross-Site-Request-Forgery.html · Nota
• http://secunia.com/advisories/58513 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4162 · Nota de Segurança