CVE-2019-5986

high-risk
Published 2019-09-12

Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to hijack the authentication of administrators via unspecified vectors.

Do I need to act?

-
0.15% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (20)

Pr-S300Ne Firmware
Rt-S300Ne Firmware
Rv-S340Ne Firmware
Pr-S300Hi Firmware
Rt-S300Hi Firmware
Rv-S340Hi Firmware
Pr-S300Se Firmware
Rt-S300Se Firmware
Rv-S340Se Firmware
Pr-400Ne Firmware
Rt-400Ne Firmware
Rv-440Ne Firmware
Pr-400Ki Firmware
Rt-400Ki Firmware
Rv-440Ki Firmware
Pr-400Mi Firmware
Rt-400Mi Firmware
Rv-440Mi Firmware
Pr-500Ki Firmware
Rt-500Ki Firmware

Affected Vendors

Ntt-East Ntt-West

References (4)

Third Party Advisory http://jvn.jp/en/jp/JVN43172719/index.html
Vendor Advisory https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html
Third Party Advisory http://jvn.jp/en/jp/JVN43172719/index.html
Vendor Advisory https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html
56
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 1/34 · Minimal
Exposure 25/34 · High