CVE-2015-7925

Опубликовано: 23 дек. 2015

Источник: nvd

CVSS3: 8

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.

Ссылки

http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01
Vendor Advisory
http://packetstormsecurity.com/files/135069/eWON-XSS-CSRF-Session-Management-RBAC-Issues.html
http://seclists.org/fulldisclosure/2015/Dec/118
http://www.securityfocus.com/bid/79625
https://ics-cert.us-cert.gov/advisories/ICSA-15-351-03
Third Party Advisory
US Government Resource
http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01
Vendor Advisory
http://packetstormsecurity.com/files/135069/eWON-XSS-CSRF-Session-Management-RBAC-Issues.html
http://seclists.org/fulldisclosure/2015/Dec/118
http://www.securityfocus.com/bid/79625
https://ics-cert.us-cert.gov/advisories/ICSA-15-351-03
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:ewon:ewon_firmware:*:*:*:*:*:*:*:*

Версия до 10.0s0 (включая)

EPSS

Процентиль: 43%

0.00211

Низкий

8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-8p3j-jhwf-33v9