CVE-2017-8406 Cross-site request forgery in n/a
An attacker can trick a logged-in user into executing actions that steal clear-text credentials from the D-Link camera's web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-8406?
CVE-2017-8406 is a high-severity vulnerability in n/a, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.
Weakness: CWE-352
Which versions are affected by CVE-2017-8406?
It affects 1 product.
Products include Dlink Dcs-1130 Firmware.
How do I fix CVE-2017-8406?
No fix has been published for CVE-2017-8406 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8406 being exploited?
There is no known exploitation of CVE-2017-8406 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8j5x-5pgf-hfjf.