CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
BID:70762
Info
CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
| Bugtraq ID: | 70762 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-8656 CVE-2014-8657 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 28 2014 12:00AM |
| Updated: | Dec 03 2014 12:56AM |
| Credit: | LiquidWorm |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
CBN CH6640E/CG6640E wireless gateway series are prone to the following security vulnerabilities:
1. Multiple information-disclosure vulnerabilities
2. A denial-of-service vulnerability
3. An HTML-injection vulnerability
4. Multiple cross-site Request-forgery vulnerabilities
An attacker can exploit these issues to obtain potentially sensitive information, cause a denial-of-service condition, perform unauthorized administrative actions and steal cookie-based authentication credentials. Other attacks are also possible.
CBN CH6640E/CG6640E wireless gateway series are prone to the following security vulnerabilities:
1. Multiple information-disclosure vulnerabilities
2. A denial-of-service vulnerability
3. An HTML-injection vulnerability
4. Multiple cross-site Request-forgery vulnerabilities
An attacker can exploit these issues to obtain potentially sensitive information, cause a denial-of-service condition, perform unauthorized administrative actions and steal cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
An attacker can exploit these issues using readily available tools. To exploit the cross-site request-forgery issue the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example data is available:
An attacker can exploit these issues using readily available tools. To exploit the cross-site request-forgery issue the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example data is available:
Solution / Fix
CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
CBN CH6640E and CG6640E Wireless Gateway Series Multiple Security Vulnerabilities
References:
References: