Cross-Site Request Forgery Vulnerability in Cisco IoT Field Network Director

CVE-2018-0270

Summary

A security issue in the web-based management interface of Cisco IoT Field Network Director allows unauthenticated remote attackers to execute cross-site request forgery (CSRF) attacks. This vulnerability arises from inadequate CSRF protection, which can lead to unauthorized alterations of user and group data on the affected device. By tricking an authenticated user into clicking on a malicious link, an attacker can perform actions with the same privileges as that user. Should the user possess administrative privileges, the attacker may create a new privileged account, gaining comprehensive control over the device. This jeopardizes the security of connected infrastructures reliant on the affected Cisco products.

References