CVE-2019-7391

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151550/Zyxel-VMG3312-B10B-DSL-491HNU-B1-V2-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://twitter.com/h1_yusufThird Party Advisory
https://www.exploit-db.com/exploits/46326/Exploit, Third Party Advisory, VDB Entry
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
http://packetstormsecurity.com/files/151550/Zyxel-VMG3312-B10B-DSL-491HNU-B1-V2-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://twitter.com/h1_yusufThird Party Advisory
https://www.exploit-db.com/exploits/46326/Exploit, Third Party Advisory, VDB Entry
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-73929.1An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gai CVE-2019-73934.3A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.CVE-2019-73948.8A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8 CVE-2019-73957.5In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.CVE-2019-73967.5In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.CVE-2019-73977.5In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.CVE-2019-73987.5In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.CVE-2019-73997.4Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.CVE-2019-74006.1Rukovoditel before 2.4.1 allows XSS.CVE-2019-74019.8NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request CVE-2019-74026.1An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can CVE-2019-74034.9An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=imp