CVE-2017-8328 - CVE House
Back to Database
Status published High CVE-2017-8328

An issue was discovered on Securifi Almond, Almond+, and Almond...

Vulnerability Description

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change a user's password. Also this is a systemic issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-8328

Credits & Attribution

No credits recorded in the NVD database.

References

More from securifi

View All →
CVE-2017-8337
An issue was discovered on Securifi Almond, Almond+, and Almond...
High 8.8
CVE-2017-8336
An issue was discovered on Securifi Almond, Almond+, and Almond...
High 8.8
CVE-2017-8335
An issue was discovered on Securifi Almond, Almond+, and Almond...
High 8
CVE-2017-8334
An issue was discovered on Securifi Almond, Almond+, and Almond...
High 8
CVE-2017-8333
An issue was discovered on Securifi Almond, Almond+, and Almond...
High 8.8

Affected Vendor

Affected Software

almond 2015 firmware, almond\+firmware, almond firmware
Vulnerable Versions:
al-r096

Timeline

Official Publish: June 18th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.