CSRF in Huawei E3236 Firmware
CVE-2014-8331
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3236 before E3276sTCPU-V200R002B470D13SP00C00 and E3276sWebUI-V100R007B100D03SP01C03 and E3276 before E3236sTCPU-V200R002B146D41SP00C00 and E3236sWebUI-V100R007B100D03SP01C03 allow remote attackers to hijack the authentication of administrators for requests that (1) change configuration settings or (2) use device functions.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
Affected products
- Huawei E3236_firmware — versions e3236s-2tcpu-22.146.29.00.00, webui-13.100.10.00.03
- Huawei E3276_firmware — versions e3276s-150tcpu-22.265.03.00.00, webui-13.100.09.00.03
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)