CVE-2023-24048

2023-12-0423:15:23

CWE-352

[email protected]

web.nvd.nist.gov

cve-2023-24048

csrf vulnerability

connectize ac21000

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

24.1%

JSON

Cross Site Request Forgery (CSRF) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /man_password.htm.

Affected configurations

Nvd

Node

connectizeac21000_g6_firmwareMatch641.139.1.1256

AND

connectizeac21000_g6Match-

VendorProductVersionCPE
connectizeac21000_g6_firmware641.139.1.1256cpe:2.3:o:connectize:ac21000_g6_firmware:641.139.1.1256:*:*:*:*:*:*:*
connectizeac21000_g6-cpe:2.3:h:connectize:ac21000_g6:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
connectize	ac21000_g6_firmware	641.139.1.1256	cpe:2.3:o:connectize:ac21000_g6_firmware:641.139.1.1256:::::::*
connectize	ac21000_g6	-	cpe:2.3:h:connectize:ac21000_g6:-:::::::*

References

research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/