PT-2017-12145 · Netcomm Wireless · Netcomm Wireless 4Gt101W

Published 2017-07-28 · Updated 2017-08-04 · CVE-2017-11646

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetComm Wireless 4GT101W version V1.1.8.8

Description The issue allows for CSRF attacks, as demonstrated by using the administration.html page to disable the firewall. This is possible because the device does not contain any token that can mitigate CSRF vulnerabilities.

Recommendations For version V1.1.8.8, as a temporary workaround, consider restricting access to the administration.html page to minimize the risk of exploitation. Avoid using the administration.html page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-11646

Affected Products

Netcomm Wireless 4Gt101W

References · 3

• https://osv.dev/vulnerability/CVE-2017-11646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11646 · Security Note
• https://iscouncil.blogspot.com/2017/07/cross-site-request-forgery.html · Note