CVE-2008-6823 Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the a...
MediumCVSS 6.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configuration via certain parameters to goform/formWanTcpipSetup or (2) modify credentials via certain parameters to goform/formPasswordSetup.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| a-link wl54ap2 | <= 1.4.1 | No fix listed |
| a-link wl54ap2 | = 1.2.0 | No fix listed |
| a-link wl54ap2 | = 1.2.1 | No fix listed |
| a-link wl54ap2 | = 1.2.2 | No fix listed |
| a-link wl54ap2 | = 1.2.3 | No fix listed |
| a-link wl54ap2 | = 1.2.4 | No fix listed |
| a-link wl54ap2 | = 1.2.5 | No fix listed |
| a-link wl54ap2 | = 1.2.6 | No fix listed |
| a-link wl54ap2 | = 1.2.7 | No fix listed |
| a-link wl54ap2 | = 1.2.8 | No fix listed |
| a-link wl54ap2 | = 1.2.9 | No fix listed |
| a-link wl54ap2 | = 1.4.0 | No fix listed |
| a-link wl54ap3 | <= 1.4.1 | No fix listed |
| a-link wl54ap3 | = 1.2.0 | No fix listed |
| a-link wl54ap3 | = 1.2.1 | No fix listed |
| a-link wl54ap3 | = 1.2.2 | No fix listed |
| a-link wl54ap3 | = 1.2.3 | No fix listed |
| a-link wl54ap3 | = 1.2.4 | No fix listed |
| a-link wl54ap3 | = 1.2.5 | No fix listed |
| a-link wl54ap3 | = 1.2.6 | No fix listed |
| a-link wl54ap3 | = 1.2.7 | No fix listed |
| a-link wl54ap3 | = 1.2.8 | No fix listed |
| a-link wl54ap3 | = 1.2.9 | No fix listed |
| a-link wl54ap3 | = 1.4.0 | No fix listed |
References
- 49466 vdb-entry
- 32421 third-party-advisory vendor-advisory
- www.a-link.com
- www.louhinetworks.fi exploit patch
- 49465 vdb-entry
- 20081031 A-Link WL54AP3 and WL54AP2 CSRF+XSS vulnerability mailing-list
- 32008 exploit vdb-entry
- wl54ap3-wl54ap2-domain-name-xss(46255) vdb-entry
- wl54ap3-wl54ap2-interface-csrf(46256) vdb-entry
- 6899 exploit