CVE-2017-8407

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-84089.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cliCVE-2017-84097.5An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and passwordCVE-2017-84109.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connectCVE-2017-84118.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cliCVE-2017-84128.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folderCVE-2017-84138.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121CVE-2017-84147.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP conneCVE-2017-84159.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieveCVE-2017-84168.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121CVE-2017-84178.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username CVE-2017-84183.3RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to otherCVE-2017-84197.8LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a deni
CVE-2017-8407: High severity, CVSS 8.8 | Vulnix