VAR-200710-0019

Vulnerability from variot - Updated: 2023-12-18 11:01

Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. Successful exploits of many of these issues will allow an attacker to completely compromise the affected device. These issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200710-0019",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "speedtouch 7g router",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "alcatel",
        "version": "*"
      },
      {
        "model": "home hub",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bt",
        "version": "*"
      },
      {
        "model": "home hub",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "bt",
        "version": "6.2.6.b"
      },
      {
        "model": "speedtouch 7g router",
        "scope": null,
        "trust": 0.8,
        "vendor": "alcatel lucent",
        "version": null
      },
      {
        "model": "speedtouch 7g router",
        "scope": null,
        "trust": 0.6,
        "vendor": "alcatel",
        "version": null
      },
      {
        "model": "tg585 router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "thomson",
        "version": "0"
      },
      {
        "model": "home hub .b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bt",
        "version": "6.2.6"
      },
      {
        "model": "home hub",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bt",
        "version": "6.2.2.6"
      },
      {
        "model": "home hub",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bt",
        "version": "0"
      },
      {
        "model": "speedtouch 7g",
        "scope": null,
        "trust": 0.3,
        "vendor": "alcatel",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "25972"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_7g_router:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:bt:home_hub:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Adrian Pastor\u203b m123303@richmond.ac.uk",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2007-5384",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2007-5384",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-28746",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2007-5384",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200710-214",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-28746",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session.  NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. \nSuccessful exploits of many of these issues will allow an attacker to completely compromise the affected device. \nThese issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "BID",
        "id": "25972"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2007-5384",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "25972",
        "trust": 2.0
      },
      {
        "db": "SREASON",
        "id": "3213",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763",
        "trust": 0.8
      },
      {
        "db": "BUGTRAQ",
        "id": "20071008 BT HOME FLUB: PWNIN THE BT HOME HUB",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-28746",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "db": "BID",
        "id": "25972"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "id": "VAR-200710-0019",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      }
    ],
    "trust": 0.975
  },
  "last_update_date": "2023-12-18T11:01:57.148000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.alcatel-lucent.com/alcatel/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.bt.com/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-352",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub"
      },
      {
        "trust": 2.0,
        "url": "http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/25972"
      },
      {
        "trust": 1.7,
        "url": "http://securityreason.com/securityalert/3213"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/481835/100/0/threaded"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5384"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5384"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/481835/100/0/threaded"
      },
      {
        "trust": 0.3,
        "url": "http://www.homehub.bt.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.gnucitizen.org/blog/call-jacking"
      },
      {
        "trust": 0.3,
        "url": "http://www.thomson.net/en/home/minisites/bap/telecom/subcategory.html?category=dsl%20modems"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/481835"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/486081"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/517314"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "db": "BID",
        "id": "25972"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "db": "BID",
        "id": "25972"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2007-10-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "date": "2007-10-08T00:00:00",
        "db": "BID",
        "id": "25972"
      },
      {
        "date": "2012-06-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "date": "2007-10-12T01:17:00",
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "date": "2007-10-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-28746"
      },
      {
        "date": "2011-04-04T20:05:00",
        "db": "BID",
        "id": "25972"
      },
      {
        "date": "2012-06-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      },
      {
        "date": "2018-10-15T21:44:14.513000",
        "db": "NVD",
        "id": "CVE-2007-5384"
      },
      {
        "date": "2007-10-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "BT Home Hub Used in  Thomson/Alcatel SpeedTouch 7G Cross-site request forgery vulnerability in router",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-002763"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "cross-site request forgery",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200710-214"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.