Vulnerability CVE-2018-5720

Vulnerability CVE-2018-5720

Published: 2018-01-29

Description:

An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead to changing an existing user's username and password, changing the Wi-Fi password, etc.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Dodocool DC38 N300 Cross-site Request Forgery	Raffaele Sabato	26.01.2018

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Dodocool -> Dc38 firmware

References:

https://www.exploit-db.com/exploits/43898/

Copyright 2024, cxsecurity.com