PT-2017-8552 · Lg · L-04D

Atsuo Sakurai · Published 2017-05-22 · Updated 2017-05-31 · CVE-2016-4854

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions L-04D firmware versions V10a through V10b

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators, enabling them to perform arbitrary operations. The exact vectors used for exploitation are not specified.

Recommendations For L-04D firmware versions V10a and V10b, consider implementing additional authentication checks to prevent CSRF attacks, such as token-based validation, until a patched version is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-4854

Affected Products

L-04D

References · 5

• https://osv.dev/vulnerability/CVE-2016-4854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4854 · Security Note
• http://securityfocus.com/bid/93278 · Note
• https://jvn.jp/en/jp/JVN46351856/index.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000194 · Note