Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks...
Vulnerability Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that (1) have unspecified impact on DDNS configuration via a request to basicDDNS.html, (2) change the wifi password via the psKey parameter to setWirelessSecurity.html, (3) add a static MAC address via the MacAddress parameter in an add_static action to setBasicDHCP1.html, or (4) enable or disable UPnP via the UPnP parameter in an apply action to setAdvancedOptions.html.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-8654
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5203.php
- http://www.securityfocus.com/bid/70762
- http://osvdb.org/show/osvdb/113843
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98329
- http://osvdb.org/show/osvdb/113842
- http://osvdb.org/show/osvdb/113841
- http://www.exploit-db.com/exploits/35075
- http://osvdb.org/show/osvdb/113840
- http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html
More from compal broadband networks
View All →Affected Vendor
compal broadband networks
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.