« Volver al listado

CVE-2015-5991

Estado: ModificadaMedia (6.8)—

Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Philippine Long Distance Telephone — Kasda Kw58293 FirmwarePhilippine Long Distance Telephone — Speedsurf 504an Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-5991",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-09-21T10:59:06.553",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/525276",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/525276",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de CSRF en form2WlanSetup.cgi en dispositivos Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN con firmware GAN9.8U26-4-TX-R6B018-PH.EN y dispositivos Kasda KW58293, permite a atacantes remotos secuestrar la autenticación de los administradores para solicitudes que realizan operaciones de configuración, según lo demostrado por la modificación de opciones de red."
    }
  ],
  "lastModified": "2026-06-17T00:30:13.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:philippine_long_distance_telephone:speedsurf_504an_firmware:gan9.8u26-4-tx-r6b018-hp.en:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB57E661-E721-4E35-8B8B-5E18D10B5937"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:philippine_long_distance_telephone:speedsurf_504an:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AD80BED5-B32C-421A-801B-15A840DDF50B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A0AA4FB-D05C-4862-8C8F-4EA0D23688AB"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9BDE9A01-C55C-4A41-828B-53D009148285"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}