Cross-Site Request Forgery in D-Link Router
CVE-2017-7404

8.8HIGH

Key Information:

Vendor

D-Link
Status
Dir-615
Vendor
CVE Published:
7 July 2017

What is CVE-2017-7404?

A vulnerability exists in D-Link's DIR-615 router that allows an attacker to exploit Cross-Site Request Forgery (CSRF). If a victim logs into the router's web interface and subsequently visits a malicious website, the attacker can send unauthorized requests to the victim's router without needing access credentials. This exploit may facilitate a POST request to Form2File.htm, aiming to upload malicious firmware, which can lead to router crashes or reboots, thereby causing a Denial of Service. Users are advised to update their firmware to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DI...
x_refsource_MISC
https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.