Unscored severity · published Jun 16, 2015
CVE-2015-2805
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E,…
–
CVSS
3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Omniswitch Firmware · Alcatel-lucent
through 6.4.5.r02; through 6.4.6.r01; through 6.6.4.r01; through 6.6.5.r02; through 7.3.2.r01; through 7.3.3.r01; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2805
Exploit
http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.html
Exploit
http://seclists.org/fulldisclosure/2015/Jun/23
www.securityfocus.com
http://www.securityfocus.com/archive/1/535732/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/75121
www.securitytracker.com
http://www.securitytracker.com/id/1032544
Exploit
https://www.exploit-db.com/exploits/37261/
More from Omniswitch Firmware
–
CVE-2015-2804
The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates…