CVE-2014-3760

D-Link DAP 1150 Firmware 1.2.94 - Cross-Site Request Forgery in Firewall/DMZ and URL-Filter Settings

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or (2) disable the DMZ in the Firewall/DMZ section via a request to index.cgi or (3) add, (4) modify, or (5) delete URL-filter settings in the Control/URL-filter section via a request to index.cgi, as demonstrated by adding a rule that blocks access to google.com.

References (2)

Core 2
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/246
Exploit x_refsource_misc
http://websecurity.com.ua/7112

Scores

EPSS 0.0032
EPSS Percentile 55.4%

Details

CWE
CWE-352
Status published
Products (2)
dlink/dap_1150
dlink/dap_1150_firmware 1.2.94
Published May 16, 2014
Tracked Since Feb 18, 2026