A vulnerability, which was classified as critical, has been found in ZTE ZXDSL 831iiv7.5.0a Z29 Ov. This issue affects an unknown code of the file accessaccount.cgi. The manipulation of the argument sysPassword with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.

The weakness was presented 08/31/2012 (Website). It is possible to read the advisory at exploit-db.com. The identification of this vulnerability is CVE-2012-4746 since 08/31/2012. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (18722) and OSVDB (76924†).

Productinfo

Vendor

• ZTE

Name

• ZXDSL

Version

• 831iiv7.5.0a Z29 Ov

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion