CVE-2018-25150 — Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration

CVE-2018-25150

Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration PUBLISHED

Description (CNA)

Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.

Affected (CNA)

Vendor / product	Versions
Ecessa Corporation / Ecessa ShieldLink SL175EHQ	affected 10.7.4

CWE

CWE-352

References

https://www.exploit-db.com/exploits/44938
https://www.ecessa.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.