CVE-2018-25152 — Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration

CVE-2018-25152

Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration PUBLISHED

Description (CNA)

Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a form that submits requests to the /cgi-bin/pl_web.cgi/util_configlogin_act endpoint to add superuser accounts with arbitrary credentials.

Affected (CNA)

Vendor / product	Versions
Ecessa Corporation / Ecessa Edge EV150	affected 10.7.4

CWE

CWE-352

References

https://www.exploit-db.com/exploits/44932
https://www.ecessa.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.