Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2018-25151

Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator into loading the page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ecessa Corporation WANWorx WVR-30

  • < 10.7.4affected
  • 10.7.4affected
  • 10.6.9affected
  • 10.6.5.2affected
  • 10.5.4affected
  • 10.2.24affected
  • 9.2.24affected

References