CVE-2007-4389
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks, via the NAME and ADDR parameters.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:M/Au:N/C:N/I:P/A:C
- EPSS
- 2.14% probability · 81th percentile
- CISA KEV
- Not listed
- Affected
- 2wire/1701hg router · 2wire/1800hw router · 2wire/2071 router
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/3026
- http://www.hakim.ws/2wire/demodns.html
- http://www.securityfocus.com/archive/1/476595/100/0/threaded
- http://www.securityfocus.com/bid/27246
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36044
- http://securityreason.com/securityalert/3026
- http://www.hakim.ws/2wire/demodns.html
- http://www.securityfocus.com/archive/1/476595/100/0/threaded
- http://www.securityfocus.com/bid/27246
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36044
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.