PT-2009-1919 · Century Systems · Xr-410+2

Hirotaka Katagiri · Published 2009-03-09 · Updated 2017-08-17 · CVE-2008-6449

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Century Systems routers including XR-410 versions prior to 1.6.9 Century Systems routers including XR-510 versions prior to 3.5.3 Century Systems routers including XR-440 versions prior to 1.7.8 Century Systems routers including XR series routers from XR-510 to XR-730 (affected versions not specified)

Description: A cross-site request forgery (CSRF) issue allows remote attackers to modify the configuration of the router as the administrator. The exact vectors used for the attack are not specified.

Recommendations: For XR-410 versions prior to 1.6.9, update to version 1.6.9 or later. For XR-510 versions prior to 3.5.3, update to version 3.5.3 or later. For XR-440 versions prior to 1.7.8, update to version 1.7.8 or later. For XR series routers from XR-510 to XR-730, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-6449

Affected Products

Xr-410

Xr-440

Xr-510

References · 6

• http://centurysys.co.jp/support/xr_common/JVN67573833.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6449 · Security Note
• http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html · Note
• http://secunia.com/advisories/31173 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43949 · Note
• http://jvn.jp/en/jp/JVN67573833/index.html · Note