CVE-2014-3760

Published: May 16, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or (2) disable the DMZ in the Firewall/DMZ section via a request to index.cgi or (3) add, (4) modify, or (5) delete URL-filter settings in the Control/URL-filter section via a request to index.cgi, as demonstrated by adding a rule that blocks access to google.com.

Affected (2)

Products: Dlink: Dap 1150 Firmware, Dap 1150

2 products

Dap 1150 Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dlink Dap 1150 Firmware	Version 1.2.94
Dlink Dap 1150	All versions

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://seclists.org/fulldisclosure/2014/Apr/246

Source: cve@mitre.org

Exploit

http://websecurity.com.ua/7112

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2014/Apr/246

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://websecurity.com.ua/7112

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.