Alcatel SpeedTouch 7G router up to 6.2.6.b cross-site request forgery

Summaryinfo

A vulnerability classified as problematic has been found in Alcatel SpeedTouch 7G router up to 6.2.6.b. The affected element is an unknown function. This manipulation causes cross-site request forgery. The identification of this vulnerability is CVE-2007-5384. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Alcatel SpeedTouch 7G router up to 6.2.6.b (Router Operating System) and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues.

The weakness was shared 10/11/2007 by Adrian Pastor with GNUCITIZEN (Website). It is possible to read the advisory at theregister.co.uk. This vulnerability is known as CVE-2007-5384 since 10/11/2007. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 25972†). The entries VDB-39200 and VDB-39198 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Alcatel

Name

• SpeedTouch 7G router

Version

• 6.2.6.a
• 6.2.6.b

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion