CVE-2008-6449 - Vulnerability Details - OpenCVE

Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9, XR-510 before 3.5.3, XR-440 before 1.7.8, and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00286.

Key SSVC decision points have not yet been added.

Vendors	Products
Centurysys	Xr-1100 Xr-410 Xr-410-l2 Xr-440 Xr-510 Xr-540 Xr-640 Xr-640-l2 Xr-730

Configuration 1 [-]

OR	cpe:2.3:h:centurysys:xr-1100::::::::
	cpe:2.3:h:centurysys:xr-410::::::::
	cpe:2.3:h:centurysys:xr-410-l2::::::::
	cpe:2.3:h:centurysys:xr-440::::::::
	cpe:2.3:h:centurysys:xr-510::::::::
	cpe:2.3:h:centurysys:xr-540::::::::
	cpe:2.3:h:centurysys:xr-640::::::::
	cpe:2.3:h:centurysys:xr-640-l2::::::::
	cpe:2.3:h:centurysys:xr-730::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://jvn.jp/en/jp/JVN67573833/index.html
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html
http://secunia.com/advisories/31173
http://www.centurysys.co.jp/support/xr_common/JVN67573833.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/43949

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-03-09T14:00:00

Updated: 2024-08-07T11:27:35.983Z

Reserved: 2009-03-09T00:00:00

Link: CVE-2008-6449

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-03-09T14:30:00.390

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-6449

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-07-22T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9, XR-510 before 3.5.3, XR-440 before 1.7.8, and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "centurysystems-router-webinterface-csrf(43949)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43949"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html"}, {"name": "JVNDB-2008-000042", "tags": ["third-party-advisory", "x_refsource_JVNDB"], "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html"}, {"name": "31173", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/31173"}, {"name": "JVN#67573833", "tags": ["third-party-advisory", "x_refsource_JVN"], "url": "http://jvn.jp/en/jp/JVN67573833/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-6449", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9, XR-510 before 3.5.3, XR-440 before 1.7.8, and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "centurysystems-router-webinterface-csrf(43949)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43949"}, {"name": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html", "refsource": "CONFIRM", "url": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html"}, {"name": "JVNDB-2008-000042", "refsource": "JVNDB", "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html"}, {"name": "31173", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/31173"}, {"name": "JVN#67573833", "refsource": "JVN", "url": "http://jvn.jp/en/jp/JVN67573833/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T11:27:35.983Z"}, "title": "CVE Program Container", "references": [{"name": "centurysystems-router-webinterface-csrf(43949)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43949"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html"}, {"name": "JVNDB-2008-000042", "tags": ["third-party-advisory", "x_refsource_JVNDB", "x_transferred"], "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html"}, {"name": "31173", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/31173"}, {"name": "JVN#67573833", "tags": ["third-party-advisory", "x_refsource_JVN", "x_transferred"], "url": "http://jvn.jp/en/jp/JVN67573833/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-6449", "datePublished": "2009-03-09T14:00:00", "dateReserved": "2009-03-09T00:00:00", "dateUpdated": "2024-08-07T11:27:35.983Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:centurysys:xr-1100:*:*:*:*:*:*:*:*", "matchCriteriaId": "53874792-ED4B-4F01-98D1-1BB64EED51CF", "versionEndIncluding": "1.6.2", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-410:*:*:*:*:*:*:*:*", "matchCriteriaId": "E18F661E-DA48-4905-8757-4465D24C10E5", "versionEndIncluding": "1.6.8", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-410-l2:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E858B01-0A21-4F8A-A226-59A7C387B477", "versionEndIncluding": "1.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-440:*:*:*:*:*:*:*:*", "matchCriteriaId": "50032952-21C9-4BE1-AF3E-065C3D442283", "versionEndIncluding": "1.7.7", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-510:*:*:*:*:*:*:*:*", "matchCriteriaId": "343DC34E-C51F-4780-9F56-6ED6E734AA34", "versionEndIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-540:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA30B120-C560-4E2D-B682-E1D366FC0A55", "versionEndIncluding": "3.5.2", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-640:*:*:*:*:*:*:*:*", "matchCriteriaId": "D95818FB-2DAD-4D15-85D7-D38A2992670C", "versionEndIncluding": "1.6.7", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-640-l2:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BC723D2-9CB8-43C8-B4AB-4AB2B4BD7DC0", "versionEndIncluding": "1.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:h:centurysys:xr-730:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F1E9349-7A5D-40A2-B50F-AAE83BCA973A", "versionEndIncluding": "3.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9, XR-510 before 3.5.3, XR-440 before 1.7.8, and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en m\u00faltiples routers de Century Systems incluyendo XR-410 anteriores a v1.6.9, XR-510 anteriores a v3.5.3, XR-440 anteriores a v1.7.8, y otros routers de la serie XR, desde XR-510 a XR-730, permite a atacantes remotos modificar la configuraci\u00f3n como administrador, a trav\u00e9s de vectores desconocidos.\r\n"}], "id": "CVE-2008-6449", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-03-09T14:30:00.390", "references": [{"source": "cve@mitre.org", "url": "http://jvn.jp/en/jp/JVN67573833/index.html"}, {"source": "cve@mitre.org", "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/31173"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43949"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://jvn.jp/en/jp/JVN67573833/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/31173"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.centurysys.co.jp/support/xr_common/JVN67573833.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43949"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}