CVE-2017-7398: CSRF
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or changing the hiddenSSID parameter, SSID parameter, or a security-option password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent CSRF exploitation by blocking unauthenticated cross-site requests to the DIR-615 administration interface (e.g., restrict router management access to trusted networks/IPs and ensure the admin UI is not reachable from untrusted clients).
- Operational
After mitigating CSRF risk, verify router wireless/security settings (Security/WPA2 mode, hiddenSSID, SSID, and the security-option password) to ensure they were not changed to unsafe values (e.g., Security changed from WPA2 to None) during exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7398?
CVE-2017-7398 is classified as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2017-7398?
To mitigate CVE-2017-7398, upgrade your D-Link DIR-615 firmware to a version that addresses this vulnerability.
What actions can an attacker perform with CVE-2017-7398?
An attacker can execute unauthorized actions, such as changing the router's security settings while the user is authenticated.
Which devices are affected by CVE-2017-7398?
CVE-2017-7398 affects D-Link DIR-615 firmware version 20.09.
Can CVE-2017-7398 be exploited remotely?
Yes, CVE-2017-7398 can be exploited remotely if the attacker has network access to the vulnerable router.