Sign-up

ID

VAR-201801-1289


CVE

CVE-2018-6391


TITLE

Netis WF2419 Cross-Site Request Forgery Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2018-04534 // CNNVD: CNNVD-201801-1052

DESCRIPTION

A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings. Netis WF2419 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NetisWF2419 is a wireless router product from China Tiandan Network (NETIS)

Trust: 2.25

sources: NVD: CVE-2018-6391 // JVNDB: JVNDB-2018-001684 // CNVD: CNVD-2018-04534 // VULHUB: VHN-136423

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-04534

AFFECTED PRODUCTS

vendor:netismodel:wf2419scope:eqversion:2.2.36123

Trust: 2.4

vendor:netismodel:wf2419scope:eqversion:v2.2.36123

Trust: 0.6

sources: CNVD: CNVD-2018-04534 // JVNDB: JVNDB-2018-001684 // CNNVD: CNNVD-201801-1052 // NVD: CVE-2018-6391

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-6391
value: HIGH

Trust: 1.0

NVD: CVE-2018-6391
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-04534
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201801-1052
value: MEDIUM

Trust: 0.6

VULHUB: VHN-136423
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-6391
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-04534
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-136423
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-6391
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-04534 // VULHUB: VHN-136423 // JVNDB: JVNDB-2018-001684 // CNNVD: CNNVD-201801-1052 // NVD: CVE-2018-6391

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-136423 // JVNDB: JVNDB-2018-001684 // NVD: CVE-2018-6391

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201801-1052

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201801-1052

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-001684

PATCH
title:WF2419url:http://www.netis-systems.com/Suppory/de_details/id/1/de/44.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-001684

EXTERNAL IDS
db:NVDid:CVE-2018-6391
Trust: 3.1
db:PACKETSTORMid:146117
Trust: 2.5
db:EXPLOIT-DBid:43919
Trust: 2.3
db:0DAYTODAYid:29659
Trust: 1.7
db:JVNDBid:JVNDB-2018-001684
Trust: 0.8
db:CNNVDid:CNNVD-201801-1052
Trust: 0.7
db:EXPLOITDBid:43919
Trust: 0.6
db:CNVDid:CNVD-2018-04534
Trust: 0.6
db:VULHUBid:VHN-136423
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-04534 // 
            
            
            
            VULHUB: VHN-136423 // 
            
            
            
            JVNDB: JVNDB-2018-001684 // 
            
            
            
            CNNVD: CNNVD-201801-1052 // 
            
            
            
            NVD: CVE-2018-6391

REFERENCES
url:https://packetstormsecurity.com/files/146117/netiswf2419-xsrf.txt
Trust: 2.5
url:https://www.exploit-db.com/exploits/43919/
Trust: 2.3
url:https://0day.today/exploit/29659
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-6391
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-6391
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2018-04534 // 
            
            
            
            VULHUB: VHN-136423 // 
            
            
            
            JVNDB: JVNDB-2018-001684 // 
            
            
            
            CNNVD: CNNVD-201801-1052 // 
            
            
            
            NVD: CVE-2018-6391

SOURCES
db:CNVDid:CNVD-2018-04534
db:VULHUBid:VHN-136423
db:JVNDBid:JVNDB-2018-001684
db:CNNVDid:CNNVD-201801-1052
db:NVDid:CVE-2018-6391

LAST UPDATE DATE
2024-11-23T22:38:17.178000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-04534date:2018-03-07T00:00:00
db:VULHUBid:VHN-136423date:2018-02-14T00:00:00
db:JVNDBid:JVNDB-2018-001684date:2018-03-01T00:00:00
db:CNNVDid:CNNVD-201801-1052date:2018-01-30T00:00:00
db:NVDid:CVE-2018-6391date:2024-11-21T04:10:37.230

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-04534date:2018-03-07T00:00:00
db:VULHUBid:VHN-136423date:2018-01-29T00:00:00
db:JVNDBid:JVNDB-2018-001684date:2018-03-01T00:00:00
db:CNNVDid:CNNVD-201801-1052date:2018-01-30T00:00:00
db:NVDid:CVE-2018-6391date:2018-01-29T19:29:01.157