Details of VAR-201707-1077

ID

VAR-201707-1077

CVE

CVE-2017-7404

TITLE

D-Link DIR-615 Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2017-005607

DESCRIPTION

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials (CSRF). An attacker can host a page that sends a POST request to Form2File.htm that tries to upload Firmware to victim's Router. This causes the router to reboot/crash resulting in Denial of Service. An attacker may succeed in uploading malicious Firmware. D-Link DIR-615 Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DIR-615 is a small wireless router product of D-Link. A security vulnerability exists in versions prior to D-Link DIR-615 20.12PTb04

Trust: 1.71

sources: NVD: CVE-2017-7404 // JVNDB: JVNDB-2017-005607 // VULHUB: VHN-115607

AFFECTED PRODUCTS

vendor:	dlink	model:	dir-615	scope:	lte	version:	20.12ptb01	Trust: 1.0
vendor:	d link	model:	dir-615	scope:	lt	version:	20.12ptb04	Trust: 0.8
vendor:	dlink	model:	dir-615	scope:	eq	version:	20.12ptb01	Trust: 0.6

sources: JVNDB: JVNDB-2017-005607 // CNNVD: CNNVD-201704-029 // NVD: CVE-2017-7404

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-7404
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-7404
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201704-029
value:	HIGH
Trust: 0.6
VULHUB:	VHN-115607
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-7404
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-115607
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-7404
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2017-7404
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-115607 // JVNDB: JVNDB-2017-005607 // CNNVD: CNNVD-201704-029 // NVD: CVE-2017-7404

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-115607 // JVNDB: JVNDB-2017-005607 // NVD: CVE-2017-7404

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201704-029

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201704-029

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-005607

PATCH

title:	DIR-615 Firmware Release Notes	url:	ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip	Trust: 0.8
title:	D-Link DIR-615 Fixes for cross-site request forgery vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148414	Trust: 0.6

sources: JVNDB: JVNDB-2017-005607 // CNNVD: CNNVD-201704-029

EXTERNAL IDS

db:	NVD	id:	CVE-2017-7404	Trust: 2.5
db:	JVNDB	id:	JVNDB-2017-005607	Trust: 0.8
db:	CNNVD	id:	CNNVD-201704-029	Trust: 0.7
db:	VULHUB	id:	VHN-115607	Trust: 0.1

sources: VULHUB: VHN-115607 // JVNDB: JVNDB-2017-005607 // CNNVD: CNNVD-201704-029 // NVD: CVE-2017-7404

REFERENCES

url:	https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf	Trust: 1.7
url:	ftp://ftp2.dlink.com/security_advisements/dir-615/revt/dir-615_revt_firmware_patch_v20.12ptb04.zip	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7404	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7404	Trust: 0.8

sources: VULHUB: VHN-115607 // JVNDB: JVNDB-2017-005607 // CNNVD: CNNVD-201704-029 // NVD: CVE-2017-7404

SOURCES

db:	VULHUB	id:	VHN-115607
db:	JVNDB	id:	JVNDB-2017-005607
db:	CNNVD	id:	CNNVD-201704-029
db:	NVD	id:	CVE-2017-7404

LAST UPDATE DATE

2024-11-23T22:42:09.184000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-115607	date:	2017-07-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-005607	date:	2017-08-02T00:00:00
db:	CNNVD	id:	CNNVD-201704-029	date:	2021-04-25T00:00:00
db:	NVD	id:	CVE-2017-7404	date:	2024-11-21T03:31:49.600

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-115607	date:	2017-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2017-005607	date:	2017-08-02T00:00:00
db:	CNNVD	id:	CNNVD-201704-029	date:	2017-04-05T00:00:00
db:	NVD	id:	CVE-2017-7404	date:	2017-07-07T12:29:00.260