CVE-2019-6961

Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other…

published June 20, 2019

CVSS
—
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other privileged configurations (intended only for the network operator) by sending an HTTP POST to the PHP backend, because the page filtering for non-superuser (in header.php) is done only for GET requests and not for direct AJAX calls.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00910 · 59.6th percentile
Published
2019-06-20T13:43Z
EPSS history
Timeline
  • 20 JUN 13:43Z
    Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other…
    cvelistv5