PT-2021-11662 · Iball · Iball Wrd12En

Published 2021-12-30 · Updated 2022-01-11 · CVE-2020-29292

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: iBall WRD12EN version 1.0.0

Description: The issue allows cross-site request forgery (CSRF) attacks. This can be demonstrated by enabling DNS settings or modifying the range for IP addresses. CSRF is an attack that tricks the victim into performing unintended actions on a web application that they are authenticated to.

Recommendations: For iBall WRD12EN version 1.0.0, as a temporary workaround, consider disabling the DNS settings modification and IP address range modification features until a patch is available. Restrict access to these features to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-29292

Affected Products

Iball Wrd12En

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-29292 · Security Note
• https://iball.co.in · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29292 · Vendor Advisory
• https://t.me/cibsecurity/34766 · Telegram Post
• https://github.com/Nitya91/iBall-WRD12EN-1.0.0 · Note
• https://t.me/cvenotify/25204 · Telegram Post