CVE-2014-100005

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-100005
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ Exploit Third Party Advisory
http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ Exploit Third Party Advisory
http://secunia.com/advisories/57304 Broken Link
http://secunia.com/advisories/57304 Broken Link
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018 Patch Vendor Advisory
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*
History

20 Dec 2024, 03:42

Type Values Removed Values Added
References (MISC) http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ - Exploit, Third Party Advisory () http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ - Exploit, Third Party Advisory
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 - Third Party Advisory, VDB Entry () https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 - Third Party Advisory, VDB Entry
References (CONFIRM) http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018 - Patch, Vendor Advisory () http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018 - Patch, Vendor Advisory
References (SECUNIA) http://secunia.com/advisories/57304 - Broken Link () http://secunia.com/advisories/57304 - Broken Link

13 Aug 2024, 19:12

Type Values Removed Values Added
CVSS v2 : 6.8
v3 : unknown 		v2 : 6.8
v3 : 8.8

08 Nov 2023, 20:19

Type Values Removed Values Added
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 - Third Party Advisory, VDB Entry
References (MISC) http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ - Exploit (MISC) http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ - Exploit, Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/57304 - (SECUNIA) http://secunia.com/advisories/57304 - Broken Link
First Time Dlink
Dlink dir-600 Firmware
Dlink dir-600
CPE cpe:2.3:o:d-link:dir-600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:d-link:dir-60:-:*:*:*:*:*:*:*		 cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*
Information

Published : 2015-01-13 11:59

Updated : 2024-12-20 03:42

NVD link : CVE-2014-100005

Mitre link : CVE-2014-100005

JSON object : View

Products Affected

dlink

  • dir-600_firmware
  • dir-600
CWE
CWE-352

Cross-Site Request Forgery (CSRF)