CSRF in QNAP Viostor Network Video Recorder

CVE-2013-0144

Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.

Affected products

Qnap Viostor_network_video_recorder — versions 4.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)