var-201303-0238
Vulnerability from variot
Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device. Sen UENO of Tricorder Co. Ltd., Hiroshi Kumagai and Kimura Youichi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, settings of the product may be initialized, or the product may be rebooted. NEC aterm is a number of wireless routing devices. Because the application allows users to perform certain operations through HTTP requests without performing any validity check, the attacker can exploit the vulnerability to perform specific operations when the logged-in administrator accesses a malicious website. action. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201303-0238",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "atermwm3600r",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8160n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8370n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8600n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3450rn",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "aterm wm3450rn",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wm3600r",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8160n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8170n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8370n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8600n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8700n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr9500n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8600n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8370n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8160n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3600r router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3450rn router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8600n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8370n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8160n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3600r",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3450rn",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr9300n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8750n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8175n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3800r",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:nec:atermwm3450rn",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwm3600r",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr8160n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr8170n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr8370n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr8600n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr8700n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:atermwr9500n",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sen UENO of Tricorder Co. Ltd, Hiroshi Kumagai and Kimura Youichi",
"sources": [
{
"db": "BID",
"id": "58625"
}
],
"trust": 0.3
},
"cve": "CVE-2013-0717",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2013-0717",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Partial",
"baseScore": 4.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2013-000024",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2013-01929",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-0717",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2013-000024",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-01929",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201303-390",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device. Sen UENO of Tricorder Co. Ltd., Hiroshi Kumagai and Kimura Youichi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, settings of the product may be initialized, or the product may be rebooted. NEC aterm is a number of wireless routing devices. Because the application allows users to perform certain operations through HTTP requests without performing any validity check, the attacker can exploit the vulnerability to perform specific operations when the logged-in administrator accesses a malicious website. action. \nExploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024",
"trust": 3.3
},
{
"db": "NVD",
"id": "CVE-2013-0717",
"trust": 3.3
},
{
"db": "JVN",
"id": "JVN59503133",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "52666",
"trust": 1.2
},
{
"db": "CNVD",
"id": "CNVD-2013-01929",
"trust": 0.6
},
{
"db": "JVN",
"id": "JVN#59503133",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390",
"trust": 0.6
},
{
"db": "BID",
"id": "58625",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"id": "VAR-201303-0238",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
}
]
},
"last_update_date": "2024-08-14T14:52:39.020000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NV13-005",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-005.html"
},
{
"title": "NEC multiple aterm router cross-site request forgery vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/32961"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://jvn.jp/en/jp/jvn59503133/index.html"
},
{
"trust": 1.9,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-005.html"
},
{
"trust": 1.6,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2013-000024"
},
{
"trust": 1.6,
"url": "http://jvn.jp/en/jp/jvn59503133/6443/index.html"
},
{
"trust": 0.9,
"url": "http://jvndb.jvn.jp/en/contents/2013/jvndb-2013-000024.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0717"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0717"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/52666/"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/52666"
},
{
"trust": 0.3,
"url": "http://jpn.nec.com/index.html"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"date": "2013-03-19T00:00:00",
"db": "BID",
"id": "58625"
},
{
"date": "2013-03-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"date": "2013-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"date": "2013-03-19T18:55:03.347000",
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"date": "2013-03-19T00:00:00",
"db": "BID",
"id": "58625"
},
{
"date": "2013-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"date": "2013-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-390"
},
{
"date": "2013-03-21T04:00:00",
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple NEC mobile routers vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
],
"trust": 0.6
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.