Vulnerability Description
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sierra Wireless | Airlink Raven Xe Firmware | <= - |
| Sierra Wireless | Airlink Raven Xe | - |
| Sierra Wireless | Airlink Raven Xt Firmware | - |
| Sierra Wireless | Airlink Raven Xt | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/98036Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02Third Party AdvisoryUS Government ResourceVDB Entry
- http://www.securityfocus.com/bid/98036Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02Third Party AdvisoryUS Government ResourceVDB Entry
FAQ
What is CVE-2017-6042?
CVE-2017-6042 is a vulnerability with a CVSS score of 8.8 (HIGH). A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify ...
How severe is CVE-2017-6042?
CVE-2017-6042 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-6042?
Check the references section above for vendor advisories and patch information. Affected products include: Sierra Wireless Airlink Raven Xe Firmware, Sierra Wireless Airlink Raven Xe, Sierra Wireless Airlink Raven Xt Firmware, Sierra Wireless Airlink Raven Xt.