Cross-Site Request Forgery Vulnerabilities in D-Link DI-524 Wireless Router
CVE-2017-5633

8HIGH

Key Information:

Vendor
D-link
Status
Di-524 Firmware
Vendor
CVE Published:
6 March 2017

Badges

👾 Exploit Exists🟡 Public PoC

Summary

Multiple vulnerabilities related to Cross-Site Request Forgery (CSRF) have been identified in the D-Link DI-524 Wireless Router with firmware version 9.01. These vulnerabilities allow remote attackers to potentially execute critical actions such as changing the admin password and rebooting the device through crafted requests sent to specific CGI programs. This could lead to unauthorized access and manipulation of network settings, compromising the security and integrity of the user’s network.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Exploit-CVE-2017-5633
Created by cardangi

References

http://www.securityfocus.com/bid/96475
vdb-entryx_refsource_BID
http://seclists.org/fulldisclosure/2017/Feb/70
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.