Vulnerability CVE-2013-7043
Published: 2013-12-10   Modified: 2013-12-11

Description:
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.

See advisories in our WLB2 database:
Topic
Author
Date
Low
DPR2320R2 [Scientific-Atlanta, Inc. Cisco ] - Multiple CSRF Vulnerability
sajith
02.12.2013

Type:

CWE-352

 (Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.3/10
8.5/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Complete
Affected software
Cisco -> Scientific atlanta dpr/epr2320 
Cisco -> Scientific atlanta dpr2325 
Cisco -> Scientific atlanta dpr/epr2320 firmware 
Cisco -> Scientific atlanta dpr2325 firmware 

 References:
http://www.exploit-db.com/exploits/29927/
http://xforce.iss.net/xforce/xfdb/89654
Copyright 2024, cxsecurity.com

 

Back to Top