CVE-2021-32424

{"id": "CVE-2021-32424", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-06-17T22:15:07.657", "references": [{"url": "https://github.com/Galapag0s/Trendnet_TW100-S4W1CA/blob/main/writeup_CSRF.txt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router."}, {"lang": "es", "value": "En TrendNet TW100-S4W1CA versi\u00f3n 2.3.32, debido a una falta de controles de sesi\u00f3n apropiados, un actor de amenazas podr\u00eda hacer cambios no autorizados en un router afectado por medio de una p\u00e1gina web especialmente dise\u00f1ada. Si un usuario autenticado interact\u00faa con una p\u00e1gina web maliciosa, podr\u00eda permitir tomar el control completo del router"}], "lastModified": "2021-06-24T15:46:23.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:trendnet:tw100-s4w1ca_firmware:2.3.32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327F5FB3-66E0-4A51-B2FE-41B2EE9F7C4E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:trendnet:tw100-s4w1ca:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EC99AA06-E488-4B56-956C-8DD53AF9A88F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}