PT-2019-8621 · Securifi · Securifi Almond+2

Mandar Satam · Publicado 2019-06-18 · Atualizado 2019-06-21 · CVE-2017-8334

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096

Description An issue was discovered where the device does not implement any cross-site scripting forgery protection mechanism. This allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.

Recommendations For firmware AL-R096, consider disabling access to the web management interface until a patch is available to prevent cross-site scripting attacks. Restrict access to the device's web management interface to minimize the risk of exploitation. Avoid using the web management interface for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-8334

Produtos afetados

Almond 2015

Almond+

Securifi Almond

Referências · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Securifi_Almond_plus_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8334 · Nota de Segurança
• https://seclists.org/bugtraq/2019/Jun/8 · Nota
• https://t.me/cibsecurity/4996 · Publicação no Telegram
• http://packetstormsecurity.com/files/153227/Securifi-Almond-2015-Buffer-Overflow-Command-Injection-XSS-CSRF.html · Nota
• https://osv.dev/vulnerability/CVE-2017-8334 · Aviso do Fabricante