Vulnerability CVE-2013-3539


Published: 2013-10-01   Modified: 2013-10-04

Description:
Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Sony CH / DH Cross Site Request Forgery
Jonas Ropero Cas...
13.06.2013

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

Vendor: SONY
Product: Snc dh140 
Product: Snc dh180 
Product: Snc ch180 
Product: Snc dh240t 
Product: Snc ch280 
Product: Snc dh140t 
Product: Snc ch140 
Product: Snc dh240 
Product: Snc ch240 
Product: Snc dh280 
Vendor: Ovislink
Product: Airlive wl2600cam 

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://seclists.org/fulldisclosure/2013/Jun/84

Related CVE
CVE-2013-3687
AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by...
CVE-2013-3686
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action.
CVE-2013-3541
Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. (dot dot) in the READ.filePath parameter.
CVE-2013-3540
Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of a...

Copyright 2019, cxsecurity.com

 

Back to Top