Cross-Site Request Forgery (CSRF) (CWE-352)
This vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting the Comtrend GRG-4280us router running firmware version WLD71-T1_v2.0.201820. A CSRF attack can force an authenticated user to perform unintended actions on the router's web interface without their knowledge or consent.
A successful CSRF attack could allow an attacker to change the router's configuration, view sensitive information, or cause a denial of service condition. This could lead to unauthorized access, data theft, or service disruption for users behind the compromised router.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
There is currently no indication that a patch has been released to address this vulnerability.
As a mitigation, users of affected Comtrend GRG-4280us routers should enable additional authentication measures like CAPTCHA or re-authentication for sensitive actions. Web browser and plugin settings to block cross-site requests can also help mitigate the risk until an official patch is available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Feedly found the first article mentioning CVE-2024-5786. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-5786
A CVSS base score of 6.5 has been assigned.
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
EPSS Score was set to: 0.04% (Percentile: 8.9%)
This CVE stopped trending in security discussions