CVE-2018-19525 Cross-site request forgery in n/a
Attackers can exploit CSRF to inject XSS payloads on Systrome ISG devices, potentially executing code or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-19525?
CVE-2018-19525 is a medium-severity vulnerability in n/a, published on 17 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation.
Which versions are affected by CVE-2018-19525?
It affects 3 products.
Products include Systrome Cumilon Isg-600c Firmware, Systrome Cumilon Isg-600h Firmware, Systrome Cumilon Isg-800w Firmware.
How do I fix CVE-2018-19525?
No fix has been published for CVE-2018-19525 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-19525 being exploited?
There is no known exploitation of CVE-2018-19525 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jr59-m722-rvrv.