CVE-2018-20576 Cross-site request forgery in n/a
Attackers can force users to make arbitrary outbound phone calls via CSRF in Orange Livebox router firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-20576?
CVE-2018-20576 is a medium-severity vulnerability in n/a, published on 28 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
Weakness: CWE-352
Which versions are affected by CVE-2018-20576?
It affects 1 product.
Products include Orange Arv7519rw22 Livebox 2.1 Firmware.
How do I fix CVE-2018-20576?
No fix has been published for CVE-2018-20576 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-20576 being exploited?
There is no known exploitation of CVE-2018-20576 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c622-72w6-7cfr.