VulnerabilityModified

CVE-2013-7043

HIGH 8.3EPSS 2.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.

CVSS 2.0: 8.3 HIGHAV:N/AC:M/Au:N/C:P/I:P/A:C
EPSS: 2.02% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: cisco/scientific atlanta dpr\/epr2320 firmware · cisco/scientific atlanta dpr\/epr2320 · cisco/scientific atlanta dpr2325 firmware · cisco/scientific atlanta dpr2325
Source: cve@mitre.org

References

http://www.exploit-db.com/exploits/29927/Exploit, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89654
http://www.exploit-db.com/exploits/29927/Exploit, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89654

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.