VAR-201303-0238
Vulnerability from variot - Updated: 2023-12-18 13:29Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device. Sen UENO of Tricorder Co. Ltd., Hiroshi Kumagai and Kimura Youichi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, settings of the product may be initialized, or the product may be rebooted. NEC aterm is a number of wireless routing devices. Because the application allows users to perform certain operations through HTTP requests without performing any validity check, the attacker can exploit the vulnerability to perform specific operations when the logged-in administrator accesses a malicious website. action. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201303-0238",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "atermwr8370n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3600r",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3450rn",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8600n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8160n",
"scope": "eq",
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"model": "aterm wm3450rn",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wm3600r",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8160n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8170n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8370n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8600n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr8700n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "aterm wr9500n",
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8600n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8370n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr8160n router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3600r router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwm3450rn router",
"scope": null,
"trust": 0.6,
"vendor": "nec",
"version": null
},
{
"model": "atermwr9500n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8600n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8370n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8160n",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3600r",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3450rn",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr9300n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8750n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwr8175n",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
},
{
"model": "atermwm3800r",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nec:atermwr9500n:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:nec:atermwr8600n:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:nec:atermwr8160n:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:nec:atermwm3450rn:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:nec:atermwr8370n:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:nec:atermwm3600r:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sen UENO of Tricorder Co. Ltd, Hiroshi Kumagai and Kimura Youichi",
"sources": [
{
"db": "BID",
"id": "58625"
}
],
"trust": 0.3
},
"cve": "CVE-2013-0717",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Partial",
"baseScore": 4.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2013-000024",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2013-01929",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-0717",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2013-000024",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-01929",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201303-390",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device. Sen UENO of Tricorder Co. Ltd., Hiroshi Kumagai and Kimura Youichi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, settings of the product may be initialized, or the product may be rebooted. NEC aterm is a number of wireless routing devices. Because the application allows users to perform certain operations through HTTP requests without performing any validity check, the attacker can exploit the vulnerability to perform specific operations when the logged-in administrator accesses a malicious website. action. \nExploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024",
"trust": 3.3
},
{
"db": "NVD",
"id": "CVE-2013-0717",
"trust": 3.3
},
{
"db": "JVN",
"id": "JVN59503133",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "52666",
"trust": 1.2
},
{
"db": "CNVD",
"id": "CNVD-2013-01929",
"trust": 0.6
},
{
"db": "JVN",
"id": "JVN#59503133",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390",
"trust": 0.6
},
{
"db": "BID",
"id": "58625",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"id": "VAR-201303-0238",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
}
]
},
"last_update_date": "2023-12-18T13:29:54.503000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NV13-005",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-005.html"
},
{
"title": "NEC multiple aterm router cross-site request forgery vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/32961"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://jvn.jp/en/jp/jvn59503133/index.html"
},
{
"trust": 1.9,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-005.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/en/jp/jvn59503133/6443/index.html"
},
{
"trust": 1.6,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2013-000024"
},
{
"trust": 0.9,
"url": "http://jvndb.jvn.jp/en/contents/2013/jvndb-2013-000024.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0717"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0717"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/52666/"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/52666"
},
{
"trust": 0.3,
"url": "http://jpn.nec.com/index.html"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"db": "BID",
"id": "58625"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"date": "2013-03-19T00:00:00",
"db": "BID",
"id": "58625"
},
{
"date": "2013-03-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"date": "2013-03-19T18:55:03.347000",
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"date": "2013-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01929"
},
{
"date": "2013-03-19T00:00:00",
"db": "BID",
"id": "58625"
},
{
"date": "2013-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-000024"
},
{
"date": "2013-03-21T04:00:00",
"db": "NVD",
"id": "CVE-2013-0717"
},
{
"date": "2013-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple NEC mobile routers vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-000024"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201303-390"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…