CVE-2015-5999

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• D-Link DIR-816L Wireless Router - Cross-Site Request Forgery2015-11-16 · webapps · hardware

Impact

Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/134379/D-Link-DIR-816L-Cross-Site-Request-Forgery.html
• http://seclists.org/fulldisclosure/2015/Nov/45
• http://www.securityfocus.com/archive/1/536886/100/0/threaded
• http://www.securityfocus.com/bid/77588
• https://www.exploit-db.com/exploits/38707/
• http://packetstormsecurity.com/files/134379/D-Link-DIR-816L-Cross-Site-Request-Forgery.html
• http://seclists.org/fulldisclosure/2015/Nov/45
• http://www.securityfocus.com/archive/1/536886/100/0/threaded
• http://www.securityfocus.com/bid/77588
• https://www.exploit-db.com/exploits/38707/