CVE-2019-6282

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151275/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/152167/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/
https://www.exploit-db.com/exploits/46581/Exploit, Third Party Advisory, VDB Entry
https://www.youtube.com/watch?v=x-r4lnWPdzYExploit, Third Party Advisory
http://packetstormsecurity.com/files/151275/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/152167/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/
https://www.exploit-db.com/exploits/46581/Exploit, Third Party Advisory, VDB Entry
https://www.youtube.com/watch?v=x-r4lnWPdzYExploit, Third Party Advisory

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-62836.5In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.CVE-2019-62846.5In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.CVE-2019-62856.5The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (s CVE-2019-62866.5In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::pa CVE-2019-62878.1In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they CVE-2019-62889.8Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.CVE-2019-62898.8uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a saf CVE-2019-62905.5An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem result CVE-2019-62915.5An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem cau CVE-2019-62926.5An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and th CVE-2019-62935.5An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the m CVE-2019-62948.8An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurr