CVE-2017-8407: dlink dcs-1130_firmware Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2017-8407 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in dlink dcs-1130_firmware. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.19%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIot Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dlink1 product
1 vendor · 1 product
References
3 links- packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdfX Refsource MISCExploitThird Party Advisory