CVE-2017-6366

Опубликовано: 15 мар. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.

Ссылки

https://www.exploit-db.com/exploits/41472/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41472/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:netgear:dgn2200_firmware:*:*:*:*:*:*:*:*

Версия до 10.0.0.50 (включая)

Одно из

cpe:2.3:h:netgear:dgn2200v1:-:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dgn2200v2:-:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dgn2200v3:-:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dgn2200v4:-:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00247

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-f99c-gfmc-7mwv