PT-2014-4174 · Conceptronic · Conceptronic C54Apm

Published 2014-01-10 · Updated 2015-08-07 · CVE-2014-1405

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via two methods: (1) the submit-url parameter in a Refresh action to "goform/formWlSiteSurvey" API endpoint, or (2) the wlan-url parameter to "goform/formWlanSetup" API endpoint.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider disabling the Refresh action to "goform/formWlSiteSurvey" and restrict access to the "goform/formWlanSetup" API endpoint to minimize the risk of exploitation. Avoid using the submit-url and wlan-url parameters in the affected API endpoints until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-1405

Affected Products

Conceptronic C54Apm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-1405 · Security Note
• http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf · Vendor Advisory
• http://osvdb.org/101916 · Note
• http://osvdb.org/101917 · Note