PT-2019-8621 · Securifi · Securifi Almond+2

Mandar Satam · Published 2019-06-18 · Updated 2019-06-21 · CVE-2017-8334

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096

Description An issue was discovered where the device does not implement any cross-site scripting forgery protection mechanism. This allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.

Recommendations For firmware AL-R096, consider disabling access to the web management interface until a patch is available to prevent cross-site scripting attacks. Restrict access to the device's web management interface to minimize the risk of exploitation. Avoid using the web management interface for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-8334

Affected Products

Almond 2015

Almond+

Securifi Almond

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Securifi_Almond_plus_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8334 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8334 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• https://t.me/cibsecurity/4996 · Telegram Post
• http://packetstormsecurity.com/files/153227/Securifi-Almond-2015-Buffer-Overflow-Command-Injection-XSS-CSRF.html · Note