Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configuration via certain parameters to goform/formWanTcpipSetup or (2) modify credentials via certain parameters to goform/formPasswordSetup.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
| Link | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46255 | vdb entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46256 | vdb entry |
| http://osvdb.org/49466 | vdb entry |
| http://www.securityfocus.com/bid/32008 | vdb entry exploit |
| http://www.osvdb.org/49465 | vdb entry |
| http://www.securityfocus.com/archive/1/497997/100/0/threaded | mailing list |
| https://www.exploit-db.com/exploits/6899 | exploit |
| http://secunia.com/advisories/32421 | third party advisory vendor advisory |
| http://www.louhinetworks.fi/advisory/alink_081028.txt | patch exploit |
| http://www.a-link.com/WL54AP3.html |