Vulnerability Note VU#278204

Verizon Fios Actiontec model MI424WR-GEN3I router vulnerable to cross-site request forgery

Original Release date: 18 Mar 2013 | Last revised: 05 Dec 2013

Overview

The Verizon FIOS Actiontec router model MI424WR-GEN3I is susceptible to cross-site request forgery attacks. (CWE-352)

Description

The Verizon FIOS Actiontec router model MI424WR-GEN3I is susceptible to cross-site request forgery attacks. (CWE-352) A remote attacker that is able to trick a user into clicking a malicious link while logged into the router may be able to compromise the router.

Impact

A remote unauthenticated attacker that is able to trick a user into clicking a malicious link while they are logged into the router may be able to compromise the router.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds.

Restrict Access

Verify the router's web interface is not Internet accessible. As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the router web interface using stolen credentials from a blocked network location.

Do Not Stay Logged Into the Router's Management Interface

Always log out of the router's management interface when done using it.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
VerizonAffected01 Feb 201318 Mar 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal 5.5 E:POC/RL:W/RC:UR
Environmental 4.2 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Jacob Holcomb of Independent Security Evaluators for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs: CVE-2013-0126
  • Date Public: 18 Mar 2013
  • Date First Published: 18 Mar 2013
  • Date Last Updated: 05 Dec 2013
  • Document Revision: 21

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.