8.8high
CVE-2017-6042
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT,…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 51%
Public exploits
0
none known
Summary
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
Exploit prediction (EPSS)
0.64% probability of exploitation in the next 30 days, higher than 51% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- n/a Sierra Wireless AirLink Raven XE and XT
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- ics-cert.us-cert.gov /advisories/ICSA-17-115-02 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/98036 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-6042
- NVD: CVE-2017-6042
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.