VAR-201104-0174
Vulnerability from variot - Updated: 2023-12-18 12:22Cross-site request forgery (CSRF) vulnerability in Forms/PortForwarding_Edit_1 on the ZyXEL O2 DSL Router Classic allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the PortRule_Name parameter. The device is produced by ZyXEL, it seems it has no other name than the brand "O2 DSL Router Classic".
As an example, the form at /Forms/PortForwarding_Edit_1 accepts javascript code for the parameter PortRule_Name, which will be permanently stored. Also, the form has no protection against CSRF.
A sample code that will inject permanent javascript when called by a user who is logged into his router:
var frm = document.getElementById("form1"); frm.submit(); This is just an example, all forms in the router interface are vulnerable to CSRF and, if they accept text input, to XSS. The vulnerability has been disclosed to O2 in advance without any reply. Disclosure Timeline 2011-02-03: Vendor contacted 2011-04-07: Published advisory This vulnerability was discovered by Hanno Boeck, http://www.hboeck.de, of schokokeks.org webhosting Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201104-0174",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "o2 dsl router classic",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"model": "o2 dsl router classic",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "*"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:zyxel:o2_dsl_router_classic:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0746"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hanno Boeck",
"sources": [
{
"db": "PACKETSTORM",
"id": "100172"
}
],
"trust": 0.1
},
"cve": "CVE-2011-0746",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-0746",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-48691",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-0746",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201104-088",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-48691",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in Forms/PortForwarding_Edit_1 on the ZyXEL O2 DSL Router Classic allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the PortRule_Name parameter. The device is produced by ZyXEL, it seems it\nhas no other name than the brand \"O2 DSL Router Classic\". \n\nAs an example, the form at /Forms/PortForwarding_Edit_1 accepts\njavascript code for the parameter PortRule_Name, which will be\npermanently stored. Also, the form has no protection against CSRF. \n\nA sample code that will inject permanent javascript when called by a\nuser who is logged into his router:\n\n\u003cform id=\"form1\" method=\"post\"\naction=\"http://192.168.1.1/Forms/PortForwarding_Edit_1\"\u003e \u003cinput\nname=\"PortRule_Name\" value=\u0027\"\u003e\u003cscript\u003ealert(7)\u003c/script\u003e\u0027\u003e \u003cinput\nname=\"PortRule_SPort\" value=\"77\"\u003e \u003cinput name=\"PortRule_EPort\"\nvalue=\"77\"\u003e \u003cinput name=\"PortRule_SrvAddr\" value=\"10.0.0.1\" \u003e\n\u003cscript\u003e\nvar frm = document.getElementById(\"form1\");\nfrm.submit();\n\u003c/script\u003e\nThis is just an example, all forms in the router interface are\nvulnerable to CSRF and, if they accept text input, to XSS. \n\nThe vulnerability has been disclosed to O2 in advance without any reply. \n\nDisclosure Timeline\n\n2011-02-03: Vendor contacted\n2011-04-07: Published advisory\n\nThis vulnerability was discovered by Hanno Boeck, http://www.hboeck.de,\nof schokokeks.org webhosting",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "PACKETSTORM",
"id": "100172"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-0746",
"trust": 2.6
},
{
"db": "SREASON",
"id": "8198",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20110407 O2 CLASSIC ROUTER: PERSISTENT CROSS SITE SCRIPTING (XSS) AND CROSS SITE REQUEST FORGERY (CSRF)",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-48691",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "100172",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "PACKETSTORM",
"id": "100172"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"id": "VAR-201104-0174",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-48691"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:19.187000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.o2online.de/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://int21.de/cve/cve-2011-0746-o2-router.html"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/517399/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://securityreason.com/securityalert/8198"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0746"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0746"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/517399/100/0/threaded"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1482"
},
{
"trust": 0.1,
"url": "http://192.168.1.1/forms/portforwarding_edit_1\"\u003e"
},
{
"trust": 0.1,
"url": "http://www.hboeck.de,"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1482"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0746"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "PACKETSTORM",
"id": "100172"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-48691"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"db": "PACKETSTORM",
"id": "100172"
},
{
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-04-13T00:00:00",
"db": "VULHUB",
"id": "VHN-48691"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"date": "2011-04-07T21:37:05",
"db": "PACKETSTORM",
"id": "100172"
},
{
"date": "2011-04-13T14:55:01.263000",
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"date": "2011-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-48691"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004236"
},
{
"date": "2018-10-09T19:29:44.580000",
"db": "NVD",
"id": "CVE-2011-0746"
},
{
"date": "2011-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL O2 DSL Router Classic of Forms/PortForwarding_Edit_1 Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004236"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201104-088"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…