Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
BID:62961
Info
Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
| Bugtraq ID: | 62961 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 09 2013 12:00AM |
| Updated: | Oct 09 2013 12:00AM |
| Credit: | Darius Freamon |
| Vulnerable: |
heatmiser Netmonitor 3.8 heatmiser Netmonitor 3.7 heatmiser Netmonitor 3.03 heatmiser Netmonitor 3.02 heatmiser Netmonitor 1.1 heatmiser Netmonitor 1.04 |
| Not Vulnerable: | |
Discussion
Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
Heatmiser Netmonitor is prone to a cross-site request-forgery and a security-bypass vulnerability.
Exploiting these issues may allow a remote attacker to perform certain administrative actions, bypass certain security restrictions, gain unauthorized access to the affected device. Other attacks are also possible.
Heatmiser Netmonitor 1.04, 1.1, 3.02, 3.03, 3.7 and 3.8 are vulnerable; other versions may also be affected.
Heatmiser Netmonitor is prone to a cross-site request-forgery and a security-bypass vulnerability.
Exploiting these issues may allow a remote attacker to perform certain administrative actions, bypass certain security restrictions, gain unauthorized access to the affected device. Other attacks are also possible.
Heatmiser Netmonitor 1.04, 1.1, 3.02, 3.03, 3.7 and 3.8 are vulnerable; other versions may also be affected.
Exploit / POC
Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
An attacker can exploit these issues through a browser. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into following a malicious URI.
An attacker can exploit these issues through a browser. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Heatmiser Netmonitor Cross Site Request Forgery and Security Bypass Vulnerabilities
References:
References:
- EE Bright Box Router Homepage (EE)
- Heatmiser NetMonitor �?? Multiple Vulnerabilities (Darius Freamon)