CVE-2017-9930
HighSummary
A Cross-Site Request Forgery (CSRF) vulnerability exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, allowing unauthorized requests such as enabling UPnP.
Risk Assessment
This vulnerability may lead to unauthorized access to device functions, posing a risk to network security.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and implement additional security measures against CSRF.
Other vulnerabilities in Green Packet DX-350 Firmware v2.8.9.5-g1.4.8-atheeb
See all- CVE-2017-9980Critical
In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the 'PING' feature within the web interface allows performing command injection via the 'pip' parameter.
- CVE-2017-9932Critical
Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of 'admin' for the admin account.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP.