CVE-2007-5384

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues.

Múltiples vulnerabilidades de tipo cross-site request forgery (CSRF) en el enrutador Thomson/Alcatel SpeedTouch 7G, como es usado por el BT Home Hub versión 6.2.6.B y anteriores, permiten a atacantes remotos realizar acciones como administradores por medio de peticiones POST no especificadas, como es demostrado por una habilitación de una sesión HTTPS de asistencia remota entrante en el puerto TCP 51003. NOTA: una omisión de autenticación puede ser aprovechada para explotar esto en la ausencia de una sesión administrativa existente. NOTA: SpeedTouch 780 también podría estar afectado por algunos de estos problemas.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-10-11 CVE Reserved
2007-10-12 CVE Published
2024-08-07 CVE Updated
2024-08-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (5)

URL	Tag	Source
http://securityreason.com/securityalert/3213	Third Party Advisory
http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub	X_refsource_misc
http://www.securityfocus.com/archive/1/481835/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/25972	Vdb Entry
http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Alcatel Search vendor "Alcatel"		Speedtouch 7g Router Search vendor "Alcatel" for product "Speedtouch 7g Router"				*		-		Affected
Bt Search vendor "Bt"		Home Hub Search vendor "Bt" for product "Home Hub"				*		-		Affected