PT-2014-5485 · D Link · D-Link Dap 1150

Published

2014-05-16

·

Updated

2023-04-26

·

CVE-2014-3760

CVSS v2.0

6.8

Medium

VectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions D-Link DAP 1150 version 1.2.94
Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including enabling or disabling the DMZ in the Firewall/DMZ section via a request to "index.cgi", and adding, modifying, or deleting URL-filter settings in the Control/URL-filter section via a request to "index.cgi". For example, an attacker could add a rule that blocks access to google.com.
Recommendations For D-Link DAP 1150 version 1.2.94, consider disabling access to the "index.cgi" endpoint until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the Firewall/DMZ and Control/URL-filter sections to minimize the risk of unauthorized changes. Avoid using the vulnerable firmware version until an update is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-3760

Affected Products

D-Link Dap 1150