cisco-sa-20181003-ind-csrf: Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ind-csrf
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20181003-ind-csrf?
The severity of cisco-sa-20181003-ind-csrf is classified as high due to the potential for unauthorized actions to be performed by attackers.
How do I fix cisco-sa-20181003-ind-csrf?
To fix cisco-sa-20181003-ind-csrf, ensure that your Cisco Industrial Network Director is updated to the latest version that addresses this vulnerability.
Who is affected by cisco-sa-20181003-ind-csrf?
Organizations using Cisco Industrial Network Director are affected by cisco-sa-20181003-ind-csrf if they do not apply the required security updates.
What types of attacks can be conducted using cisco-sa-20181003-ind-csrf?
cisco-sa-20181003-ind-csrf can be exploited to conduct cross-site request forgery (CSRF) attacks, allowing unauthorized actions on the device.
Is authentication required to exploit cisco-sa-20181003-ind-csrf?
No, authentication is not required to exploit cisco-sa-20181003-ind-csrf, making it particularly dangerous for affected users.