CVE-2024-45372

EPSS 0.05%
Published 26.09.2024 05:15:12
Last modified 25.03.2025 16:15:24
Source vultures@jpcert.or.jp
Teams watchlist Login
Open Login

MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web management page of the affected product may lead the user to perform unintended operations such as changing the login password, etc.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Planex ≫ Mzk-dp300n Firmware Version <= 1.04

Planex ≫ Mzk-dp300n Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.144

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://jvn.jp/en/jp/JVN81966868/

Third Party Advisory

https://www.planex.co.jp/support/download/mzk-dp300n/

Product

https://nvd.nist.gov/vuln/detail/CVE-2024-45372

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-45372

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-45372

EUVD