8.0high
CVE-2017-56331 exploit
Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers t…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.0%
percentile 90%
Public exploits
1
Exploit-DB
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the admin password, (2) reboot the device, or (3) possibly have unspecified other impact via crafted requests to CGI programs.
Exploit prediction (EPSS)
3.96% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
Exploits and detections
- EDB-40983 D-Link DI-524 - Cross-Site Request Forgery · webapps · 2016-12-09
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 8.5 | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- securityfocus.com /bid/96475 · vdb-entry, x_refsource_BID, x_transferred
- seclists.org /fulldisclosure/2017/Feb/70 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-5633
- NVD: CVE-2017-5633
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.