A vulnerability has been reported in various Century Systems routers, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The vulnerability is caused due to the device allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. change the administrator password by enticing a logged-in administrator to visit a malicious site.

The vulnerability reportedly affects the following router and firmware versions:
* XR-410 version 1.6.8 and prior
* XR-440 version 1.7.7 and prior
* XR-510 version 3.5.0 and prior
* XR-540 version 3.5.2 and prior
* XR-640 version 1.6.7 and prior
* XR-730 version 3.5.0 and prior
* XR-1100 version 1.6.2 and prior
* XR-410-L2 version 1.6.1 and prior
* XR-640-L2 version 1.6.1 and prior

Solution
Update to the fixed firmware versions.
Further details available in Customer Area

Provided and/or discovered by
Reported via JVN.

Changelog
Further details available in Customer Area

Original Advisory
JVN#67573833:
http://jvn.jp/jp/JVN67573833/index.html

Century Systems:
http://www.centurysys.co.jp/support/xr_common/JVN67573833.html

Deep Links
Links available in Customer Area