Netgear JNR1010 up to 1.0.0.31 cgi-bin/webproc Parameter cross-site request forgery

Summaryinfo

A vulnerability classified as problematic was found in Netgear JNR1010 up to 1.0.0.31. This affects an unknown function of the file cgi-bin/webproc of the component InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL. The manipulation of the argument InternetGatewayDeviceX_TWSZ-COM_URL_FilterBlackList1URL as part of Parameter results in cross-site request forgery. This vulnerability is cataloged as CVE-2016-11015. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Netgear JNR1010 up to 1.0.0.31. Affected is an unknown function of the file cgi-bin/webproc of the component InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL. The manipulation of the argument InternetGatewayDeviceX_TWSZ-COM_URL_FilterBlackList1URL as part of a Parameter leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter.

The weakness was shared 10/16/2019. This vulnerability is traded as CVE-2016-11015 since 10/16/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 1.0.0.32 eliminates this vulnerability.

The entries VDB-143515 and VDB-143513 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Netgear

Name

• JNR1010

Version

• 1.0.0.0
• 1.0.0.1
• 1.0.0.2
• 1.0.0.3
• 1.0.0.4
• 1.0.0.5
• 1.0.0.6
• 1.0.0.7
• 1.0.0.8
• 1.0.0.9
• 1.0.0.10
• 1.0.0.11
• 1.0.0.12
• 1.0.0.13
• 1.0.0.14
• 1.0.0.15
• 1.0.0.16
• 1.0.0.17
• 1.0.0.18
• 1.0.0.19
• 1.0.0.20
• 1.0.0.21
• 1.0.0.22
• 1.0.0.23
• 1.0.0.24
• 1.0.0.25
• 1.0.0.26
• 1.0.0.27
• 1.0.0.28
• 1.0.0.29
• 1.0.0.30
• 1.0.0.31

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion