WL-330NUL up to 3.0.0.45 cross-site request forgery

Summaryinfo

A vulnerability was found in WL-330NUL up to 3.0.0.45. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The identification of this vulnerability is CVE-2018-0647. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in WL-330NUL up to 3.0.0.45 and classified as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The bug was discovered 07/20/2018. The weakness was shared 09/07/2018 (Website). The advisory is shared at jvn.jp. This vulnerability is known as CVE-2018-0647 since 11/26/2017. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 49 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.0.0.46 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• WL-330NUL

Version

• 3.0.0.0
• 3.0.0.1
• 3.0.0.2
• 3.0.0.3
• 3.0.0.4
• 3.0.0.5
• 3.0.0.6
• 3.0.0.7
• 3.0.0.8
• 3.0.0.9
• 3.0.0.10
• 3.0.0.11
• 3.0.0.12
• 3.0.0.13
• 3.0.0.14
• 3.0.0.15
• 3.0.0.16
• 3.0.0.17
• 3.0.0.18
• 3.0.0.19
• 3.0.0.20
• 3.0.0.21
• 3.0.0.22
• 3.0.0.23
• 3.0.0.24
• 3.0.0.25
• 3.0.0.26
• 3.0.0.27
• 3.0.0.28
• 3.0.0.29
• 3.0.0.30
• 3.0.0.31
• 3.0.0.32
• 3.0.0.33
• 3.0.0.34
• 3.0.0.35
• 3.0.0.36
• 3.0.0.37
• 3.0.0.38
• 3.0.0.39
• 3.0.0.40
• 3.0.0.41
• 3.0.0.42
• 3.0.0.43
• 3.0.0.44
• 3.0.0.45

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion