CVE-2007-6730

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in the ZyXEL P-330W router allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote router management via goform/formRmtMgt or (2) modify the administrator password via goform/formPasswordSetup.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2007/Dec/0559.htmlExploit
http://secunia.com/advisories/28172Vendor Advisory
http://www.securityfocus.com/bid/27024
http://seclists.org/fulldisclosure/2007/Dec/0559.htmlExploit
http://secunia.com/advisories/28172Vendor Advisory
http://www.securityfocus.com/bid/27024

Timeline

Published: Sep 10, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-673110.0Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which CVE-2007-673210.0Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attacke CVE-2007-67334.7The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group CVE-2007-67344.0NWFTPD.nlm before 5.08.07 in the FTP server in Novell NetWare 6.5 SP7 does not properly implement the FTPREST.TXT NOREMOTE restriction, whic CVE-2007-67357.5NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TX CVE-2007-67366.5Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary CVE-2007-67377.5FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, CVE-2007-67385.0pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attack CVE-2007-67395.0FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.CVE-2007-67404.0The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which m CVE-2007-67416.5The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP a CVE-2007-67426.8The get_filter_list function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0006 does not properly perform certain sub f