CVE-2017-8334 An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management int...
HighCVSS 8.0
EPSS 0.91%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| securifi almond 2015 firmware | = al-r096 | No fix listed |
| securifi almond+firmware | = al-r096 | No fix listed |
| securifi almond firmware | = al-r096 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- github.com exploit third-party-advisory
- 20190609 Newly releases IoT security issues mailing-list third-party-advisory