Cross site request forgery (csrf)

2022-08-1721:15:00

PRIOn knowledge base

www.prio-n.com

csrf

vulnerability

iptime nas

remote attackers

steal root privileges

malicious post request

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.3%

JSON

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.

CPENameOperatorVersion
nas1dual_firmwarelt1.4.86
nas2dual_firmwarelt1.4.86
nas4dual_firmwarelt1.4.86

Name	Operator	Version
nas1dual_firmware	lt	1.4.86
nas2dual_firmware	lt	1.4.86
nas4dual_firmware	lt	1.4.86

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877