« Volver al listado

CVE-2008-5382

Estado: ModificadaMedia (6.8)—

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en I-O DATA DEVICE HDL-F160, HDL-F250, HDL-F300 y HDL-F320 con software empotrado (firmware) anterior a v1.02; permite a atacantes remotos (1) cambiar una configuración o (2) eliminar ficheros como un usuario autenticado a través de vectores desconocidos. NOTA: El origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

I-O Data — Hlf-f160I-O Data — Hlf-f250I-O Data — Hlf-f300I-O Data — Hlf-f320

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-5382",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-09T00:30:00.360",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN70599814/index.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50183",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32836",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.iodata.jp/news/2008/important/hdl-f.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46880",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN70599814/index.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/50183",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32836",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.iodata.jp/news/2008/important/hdl-f.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in I-O DATA DEVICE HDL-F160, HDL-F250, HDL-F300, and HDL-F320 firmware before 1.02 allows remote attackers to (1) change a configuration or (2) delete files as an authenticated user via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en I-O DATA DEVICE HDL-F160, HDL-F250, HDL-F300 y HDL-F320 con software empotrado (firmware) anterior a v1.02; permite a atacantes remotos (1) cambiar una configuración o (2) eliminar ficheros como un usuario autenticado a través de vectores desconocidos. NOTA: El origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T22:59:52.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:i-o_data:hlf-f160:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B2C515-0A02-4160-8149-29F77CF0B8E4"
            },
            {
              "criteria": "cpe:2.3:h:i-o_data:hlf-f250:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1822C4EF-46E9-4B8A-9B0F-E7E95869A671"
            },
            {
              "criteria": "cpe:2.3:h:i-o_data:hlf-f300:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47EA1796-68AD-42F4-B6E8-7F64120ECA8C"
            },
            {
              "criteria": "cpe:2.3:h:i-o_data:hlf-f320:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DBC0818-80EE-4452-8168-21CBD86BBFB4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}