PT-2014-4175 · Conceptronic · Conceptronic C54Apm
Published
2014-01-10
·
Updated
2014-05-05
·
CVE-2014-1406
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Conceptronic C54APM access point with runtime code 1.26
Description
The issue concerns a CRLF injection vulnerability. This allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the
submit-url parameter in a Refresh action.Recommendations
For Conceptronic C54APM access point with runtime code 1.26, avoid using the
submit-url parameter in the Refresh action until the issue is resolved. Restrict access to the goform/formWlSiteSurvey endpoint to minimize the risk of exploitation.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Conceptronic C54Apm