CVE-2016-11015

moderate-risk
Published 2019-10-16

NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter.

Do I need to act?

-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Netgear

References (10)

Exploit https://cybersecurityworks.com/zerodays/cve-2016-11015-netgear.html
Exploit https://github.com/cybersecurityworks/Disclosed/issues/13
Exploit https://lists.openwall.net/full-disclosure/2016/01/11/4
Exploit https://packetstormsecurity.com/files/135215/Netgear-1.0.0.24-Cross-Site-Request...
Third Party Advisory https://pmcg2k15.wordpress.com/2016/01/11/fd-cross-site-request-forgery-in-netge...
Exploit https://cybersecurityworks.com/zerodays/cve-2016-11015-netgear.html
Exploit https://github.com/cybersecurityworks/Disclosed/issues/13
Exploit https://lists.openwall.net/full-disclosure/2016/01/11/4
Exploit https://packetstormsecurity.com/files/135215/Netgear-1.0.0.24-Cross-Site-Request...
Third Party Advisory https://pmcg2k15.wordpress.com/2016/01/11/fd-cross-site-request-forgery-in-netge...
30
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal