CVE-2017-6042

A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
References
Link Resource
http://www.securityfocus.com/bid/98036 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02 Third Party Advisory US Government Resource VDB Entry
http://www.securityfocus.com/bid/98036 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02 Third Party Advisory US Government Resource VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sierra_wireless:airlink_raven_xe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:sierra_wireless:airlink_raven_xe:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sierra_wireless:airlink_raven_xt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sierra_wireless:airlink_raven_xt:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:28

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/98036 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/98036 - Third Party Advisory, VDB Entry
References () https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02 - Third Party Advisory, US Government Resource, VDB Entry () https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02 - Third Party Advisory, US Government Resource, VDB Entry

Information

Published : 2017-06-30 03:29

Updated : 2024-11-21 03:28


NVD link : CVE-2017-6042

Mitre link : CVE-2017-6042

CVE.ORG link : CVE-2017-6042


JSON object : View

Products Affected

sierra_wireless

  • airlink_raven_xe_firmware
  • airlink_raven_xt_firmware
  • airlink_raven_xt
  • airlink_raven_xe
CWE
CWE-352

Cross-Site Request Forgery (CSRF)