Customer Area
Need help?
Try CSI
Scan Now
Secunia Advisory SA38591Huawei HG510 Security Bypass and Cross-Site Request Forgery Vulnerabilities
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Description
Ivan Markovic has reported some vulnerabilities in Huawei HG510, which can be exploited by malicious people to bypass certain security restrictions and conduct cross-site request forgery attacks. 1) The device allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. reboot the device or change certain settings (including passwords). 2) The device does not properly restrict access to the rebootinfo.cgi script. This can be exploited to reboot the device by accessing the script directly. Note: This can also be exploited via cross-site request forgery attacks (see vulnerability #1). Solution Provided and/or discovered by Deep Links Do you have additional information related to this advisory?Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Latest advisories
See all
395 views
331 views
393 views
