CVEvulnerability
CVE-2017-7851
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-11-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header.
Affected configurations
• d-link dcs-936l (< 1.05.07)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/BETA/DCS-936L_REVA_RELEASE_NOTES_v1.05.07_EN.pdf Issue Tracking, Release Notes, Vendor Advisory
- https://www.qualys.com/2017/03/26/qsa-2017-03-26/qsa-2017-03-26.pdf Exploit, Issue Tracking, Third Party Advisory
- ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/BETA/DCS-936L_REVA_RELEASE_NOTES_v1.05.07_EN.pdf Issue Tracking, Release Notes, Vendor Advisory
- https://www.qualys.com/2017/03/26/qsa-2017-03-26/qsa-2017-03-26.pdf Exploit, Issue Tracking, Third Party Advisory