CVEvulnerability

CVE-2011-0886

6.8 MEDIUM Published 2011-02-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-02-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 allow remote attackers to (1) hijack the intranet connectivity of arbitrary users for requests that perform a login via goform/login, or hijack the authentication of administrators for requests that (2) enable external logins via an mso_remote_enable action to goform/RemoteRange or (3) change DNS settings via a manual_dns_enable action to goform/Basic.

Affected configurations

• smc networks smcd3g-ccr • smc networks smcd3g-ccr firmware (<= 1.4.0.49) • smc networks smcd3g-ccr firmware 1.4.0.42

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References