Details of VAR-201702-0960

ID

VAR-201702-0960

CVE

CVE-2017-6127

TITLE

DigiSol DG-HR1400 Wireless Router Cross-Site Request Forgery Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2017-02425 // CNNVD: CNNVD-201702-742

DESCRIPTION

Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID, (2) change the Wi-Fi password, or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi. The DigiSolDG-HR1400 WirelessRouter is a wireless broadband home router. A cross-site request forgery vulnerability exists in the accessportal of DigiSolDG-HR1400 WirelessRouter. Allows remote attackers to build malicious URIs, entice users to resolve, and perform malicious actions in the target user context. DIGISOL DG-HR1400 is prone to multiple cross-site request-forgery vulnerabilities. This may lead to further attacks. DG-HR1400 1.00.02 is vulnerable; other versions may also be affected

Trust: 2.52

sources: NVD: CVE-2017-6127 // JVNDB: JVNDB-2017-001674 // CNVD: CNVD-2017-02425 // BID: 96369 // VULHUB: VHN-114330

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-02425

AFFECTED PRODUCTS

vendor:	digisol	model:	dg-hr1400	scope:	eq	version:	1.00.02	Trust: 1.6
vendor:	digisol	model:	dg-hr1400	scope:	eq	version:	1.0.2	Trust: 0.9
vendor:	smartlink network	model:	digisol dg-hr1400	scope:	-	version:	-	Trust: 0.8
vendor:	smartlink network	model:	digisol dg-hr1400	scope:	eq	version:	1.00.02	Trust: 0.8

sources: CNVD: CNVD-2017-02425 // BID: 96369 // JVNDB: JVNDB-2017-001674 // NVD: CVE-2017-6127 // CNNVD: CNNVD-201702-742

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2017-6127
value:	HIGH
Trust: 1.8
CNVD:	CNVD-2017-02425
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201702-742
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-114330
value:	MEDIUM
Trust: 0.1

NVD:
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	TRUE
version:	2.0
Trust: 1.0
NVD:	CVE-2017-6127
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2017-02425
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-114330
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

NVD:
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	CVE-2017-6127
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2017-02425 // VULHUB: VHN-114330 // JVNDB: JVNDB-2017-001674 // NVD: CVE-2017-6127 // CNNVD: CNNVD-201702-742

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-114330 // JVNDB: JVNDB-2017-001674 // NVD: CVE-2017-6127

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201702-742

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201702-742

CONFIGURATIONS

sources: NVD: CVE-2017-6127

PATCH

title:

DIGISOL DG-HR1400

url:

http://wifi.digisol.com/datasheets/dg-hr1400.pdf

Trust: 0.8

sources: JVNDB: JVNDB-2017-001674

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6127	Trust: 3.4
db:	BID	id:	96369	Trust: 2.0
db:	JVNDB	id:	JVNDB-2017-001674	Trust: 0.8
db:	CNNVD	id:	CNNVD-201702-742	Trust: 0.7
db:	CNVD	id:	CNVD-2017-02425	Trust: 0.6
db:	VULHUB	id:	VHN-114330	Trust: 0.1

sources: CNVD: CNVD-2017-02425 // VULHUB: VHN-114330 // BID: 96369 // JVNDB: JVNDB-2017-001674 // NVD: CVE-2017-6127 // CNNVD: CNNVD-201702-742

REFERENCES

url:	https://drive.google.com/file/d/0b6715xuqh18mev9gove0zmfrquu/view	Trust: 2.3
url:	http://seclists.org/fulldisclosure/2017/feb/66	Trust: 1.9
url:	http://www.securityfocus.com/bid/96369	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6127	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6127	Trust: 0.8
url:	http://wifi.digisol.com/datasheets/dg-hr1400.pdf	Trust: 0.3
url:	http://seclists.org/fulldisclosure/2017/feb/55	Trust: 0.3

sources: CNVD: CNVD-2017-02425 // VULHUB: VHN-114330 // BID: 96369 // JVNDB: JVNDB-2017-001674 // NVD: CVE-2017-6127 // CNNVD: CNNVD-201702-742

CREDITS

Indrajith A N

Trust: 0.3

sources: BID: 96369

SOURCES

db:	CNVD	id:	CNVD-2017-02425
db:	VULHUB	id:	VHN-114330
db:	BID	id:	96369
db:	JVNDB	id:	JVNDB-2017-001674
db:	NVD	id:	CVE-2017-6127
db:	CNNVD	id:	CNNVD-201702-742

LAST UPDATE DATE

2023-12-18T13:03:10.262000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-02425	date:	2017-03-06T00:00:00
db:	VULHUB	id:	VHN-114330	date:	2017-03-02T00:00:00
db:	BID	id:	96369	date:	2017-03-07T02:06:00
db:	JVNDB	id:	JVNDB-2017-001674	date:	2017-03-13T00:00:00
db:	NVD	id:	CVE-2017-6127	date:	2017-03-02T02:59:02.803
db:	CNNVD	id:	CNNVD-201702-742	date:	2017-02-22T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-02425	date:	2017-03-06T00:00:00
db:	VULHUB	id:	VHN-114330	date:	2017-02-21T00:00:00
db:	BID	id:	96369	date:	2017-02-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-001674	date:	2017-03-13T00:00:00
db:	NVD	id:	CVE-2017-6127	date:	2017-02-21T20:59:00.157
db:	CNNVD	id:	CNNVD-201702-742	date:	2017-02-22T00:00:00