CVE-2015-5999: dlink dir-816l_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2015-5999 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in dlink dir-816l_firmware. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 18-11-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.