U.S.Robotics USR5463 Firmware '/cgi-bin/setup_ddns.exe' Cross-Site Request Forgery Vulnerability

Bugtraq ID:	40348
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 25 2010 12:00AM
Updated:	May 25 2010 06:32PM
Credit:	David K.
Vulnerable:	U.S.Robotics USR5463 0.06 U.S.Robotics USR5463 0.05 U.S.Robotics USR5463 0.04 U.S.Robotics USR5463 0.03 U.S.Robotics USR5463 0.02 U.S.Robotics USR5463 0.01
Not Vulnerable:

U.S.Robotics USR5463 Firmware '/cgi-bin/setup_ddns.exe' Cross-Site Request Forgery Vulnerability

U.S.Robotics USR5463 firmware is prone to a cross-site request-forgery vulnerability.

Successful exploits may allow attackers to perform unauthorized actions on the affected device in the context of a logged-in user. This may allow attackers to gain access to or modify sensitive information and perform HTML-injection attacks.

U.S.Robotics USR5463 firmware versions 0.01 through 0.06 are vulnerable.

U.S.Robotics USR5463 Firmware '/cgi-bin/setup_ddns.exe' Cross-Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.

U.S.Robotics USR5463 Firmware '/cgi-bin/setup_ddns.exe' Cross-Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

U.S.Robotics USR5463 Firmware '/cgi-bin/setup_ddns.exe' Cross-Site Request Forgery Vulnerability

References:

• USR5463 802.11g Wireless Router - Homepage (U.S.Robotics)