vulnwire
8.8high

CVE-2017-2223

Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and e…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known

Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Exploit prediction (EPSS)

0.91% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • I-O DATA DEVICE, INC. TS-WPTCAM
  • I-O DATA DEVICE, INC. TS-PTCAM
  • I-O DATA DEVICE, INC. TS-PTCAM/POE
  • I-O DATA DEVICE, INC. TS-WLC2
  • I-O DATA DEVICE, INC. TS-WLCE
  • I-O DATA DEVICE, INC. TS-WRLC
  • I-O DATA DEVICE, INC. TS-WPTCAM2

Classification

Weakness

References

  • iodata.jp /support/information/2017/camera201706/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/99144 · vdb-entry, x_refsource_BID, x_transferred
  • jvn.jp /en/jp/JVN65411235/index.html · third-party-advisory, x_refsource_JVN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.