CVE-2017-8328 Cross-site request forgery in n/a
Attackers can trick logged-in users into changing administrative passwords via CSRF, leading to account takeover on Securifi Almond devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-8328?
CVE-2017-8328 is a high-severity vulnerability in n/a, published on 18 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change a user's password. Also this is a systemic issue.
Weakness: CWE-352
Which versions are affected by CVE-2017-8328?
It affects 3 products.
Products include Securifi Almond\+firmware, Securifi Almond 2015 Firmware, Securifi Almond Firmware.
How do I fix CVE-2017-8328?
No fix has been published for CVE-2017-8328 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8328 being exploited?
There is no known exploitation of CVE-2017-8328 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2898-phr2-m6mc.