CVE-2016-11055: netgear cm400_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2016-11055 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in netgear cm400_firmware. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.8% of scored vulnerabilities.

Timeline

1. 28-04-2020
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, DST6501 before 2017-01-11, JNR1010v1 before 2017-01-11, JWNR2000Tv3 before 2017-01-11, JWNR2010v3 before 2017-01-11, PLW1000 before 2017-01-11, PLW1010 before 2017-01-11, WNR500 before 2017-01-11, WNR612v3 before 2017-01-11, N450 before 2017-01-11, and CG3000Dv2 before 2017-01-11.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.