CVE-2017-7398: d-link dir-615_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2017-7398 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in d-link dir-615_firmware. EPSS estimates a 3.01% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-04-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or changing the hiddenSSID parameter, SSID parameter, or a security-option password.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.