CVE-2017-5165
HighSummary
An issue was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter related to the lack of CSRF Token generation per page and/or for sensitive functions. This allows silent execution of unauthorized actions, such as configuration parameter changes.
Risk Assessment
Successful exploitation of this vulnerability can lead to unauthorized changes in the device's configuration, posing a serious threat to the integrity of the system.
Recommendation
It is recommended to implement a mechanism for generating CSRF tokens for each page and sensitive functions to secure the device against unauthorized access.
Other vulnerabilities in BINOM3 Universal Multifunctional Electric Power Quality Meter
See all- CVE-2017-5167High
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter that prevents users from changing their own passwords.
- CVE-2017-5166Critical
An INFORMATION EXPOSURE flaw was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter. This vulnerability can be exploited to gain privileged access to the device.
- CVE-2017-5162Critical
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter related to lack of authentication for remote service, allowing access to application setup and configuration.
Original NVD description (English source)
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) function. Successful exploitation of this vulnerability can allow silent execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.