Design/Logic Flaw

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

CVE-2015-2915

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the...

CVE-2015-2915

CVE-2015-2915 affects Securifi Almond devices: firmware before AL1-R201EXP10-L304-W34 and Almond-2015 before AL2-R088M use a default admin password, enabling a local intranet attacker to gain web-management access. The vulnerability is due to default credentials that allow authentication without ...

CVE-2015-2916

CVE-2015-2916 affects Securifi Almond devices (AL1 firmware ≤ R201EXP10-L304-W34; Almond 2015 ≤ AL2-R088M). The flaw is a Cross-Site Request Forgery in the web management interface that lets an attacker hijack a user’s authenticated session and perform actions with the user’s privileges. The issu...

CVE-2015-2914

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by using this number f...

CVE-2015-2917

The CVE-2015-2917 entry affects Securifi Almond devices and Almond 2015 devices where the web management interface omits the X-Frame-Options header, enabling clickjacking via crafted pages using FRAME/IFRAME/OBJECT. Root cause: missing X-Frame-Options header in affected firmware before AL1-R201EX...

CVE-2015-2916

Cross-site request forgery CSRF vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-2914

CVE-2015-2914 affects Securifi Almond devices running firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices before AL2-R088M. The issue is a fixed source-port number used in outbound DNS queries performed on behalf of any device, which, in combination with the destination port, facilitat...

CVE-2015-2917

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

CVE-2015-7296

Securifi Almond devices prior to AL1-R201EXP10-L304-W34 and Almond-2015 devices prior to AL2-R088M are affected by a vulnerability in DNS query ID selection: the devices use a linear algorithm to choose the ID in DNS query headers, which can allow remote attackers to spoof responses (e.g., direct...

CVE-2015-7296

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof...

Securifi Almond Security Bypass Vulnerability

Securifi Almond is a wireless router product from Securifi. Securifi Almond uses static source ports for DNS queries in the local network, allowing an attacker to exploit a vulnerability that can be exploited to spoof DNS responses and allow Almond LAN clients to connect to incorrect or malicious...

Securifi Almond Cross-Site Request Forgery Vulnerability

Securifi Almond is a wireless router product from Securifi. Securifi Almond uses a default password and suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context...

Securifi Almond Access Restriction Bypass Vulnerability

Securifi Almond is a wireless router product from Securifi. The Securifi Almond 2015's web management interface does not enforce the same-origin policy in the X-Frame-Options response header, allowing remote attackers to exploit specially crafted web pages that can be used for clickjacking attack...

Securifi Almond Cross-Site Request Forgery Vulnerability (CNVD-2015-06095)

Securifi Almond is a wireless router product from Securifi. Securifi Almond suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the target user...

Securifi Almond routers contains multiple vulnerabilities

Overview Securifi Almond, firmware version AL1-R200-L302-W33 and earlier, and Securifi Almond 2015, firmware version AL2-R088 and earlier, contain multiple vulnerabilities. Description CWE-330: Use of Insufficiently Random Values - CVE-2015-2914Securifi Almond and Almond 2015 use static source...