PT-2014-5713 · Zyxel · Zyxel P-660Hw-T1

Mustafa Altinkaynak · Published 2014-06-16 · Updated 2014-07-17 · CVE-2014-4162

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zyxel P-660HW-T1 version v3

Description The issue affects the Zyxel P-660HW-T1 wireless router, where multiple cross-site request forgery (CSRF) vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in question are those that change the wifi password or the SSID, which can be executed via a request to "Forms/WLAN General 1".

Recommendations For Zyxel P-660HW-T1 version v3, consider disabling access to the "Forms/WLAN General 1" endpoint until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the wifi password and SSID change functionalities to minimize the risk of unauthorized changes.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-4162

Affected Products

Zyxel P-660Hw-T1

References · 6

• 🔥 https://exploit-db.com/exploits/33518 · Exploit
• 🔥 http://exploit-db.com/exploits/33518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4162 · Security Note
• http://osvdb.org/show/osvdb/107449 · Note
• http://packetstormsecurity.com/files/126812/Zyxel-P-660HW-T1-Cross-Site-Request-Forgery.html · Note
• http://secunia.com/advisories/58513 · Note