CVE-2017-7851

Опубликовано: 15 нояб. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header.

Ссылки

ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/BETA/DCS-936L_REVA_RELEASE_NOTES_v1.05.07_EN.pdf
Issue Tracking
Release Notes
Vendor Advisory
https://www.qualys.com/2017/03/26/qsa-2017-03-26/qsa-2017-03-26.pdf
Exploit
Issue Tracking
Third Party Advisory
ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/BETA/DCS-936L_REVA_RELEASE_NOTES_v1.05.07_EN.pdf
Issue Tracking
Release Notes
Vendor Advisory
https://www.qualys.com/2017/03/26/qsa-2017-03-26/qsa-2017-03-26.pdf
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:d-link:dcs-936l:*:*:*:*:*:*:*:*

Версия до 1.05.07 (исключая)

cpe:2.3:h:dlink:dcs-936l:-:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00295

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-946m-gq3w-5gwc