Teradek Slice Cross-Site Request Forgery Vulnerability in Version 7.3.15

A cross-site request forgery (CSRF) vulnerability has been identified in the Teradek Slice firmware version 7.3.15. This vulnerability allows attackers to change administrative passwords without proper request validation. By crafting a malicious web page that automatically submits password change requests, an attacker can exploit this issue when a logged-in user visits the page.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to unauthorized administrative access.

Reproduction

To reproduce this vulnerability, a CSRF exploit can be used. This involves creating a web page that automatically sends a password change request to the Teradek Slice device. The request must include the new password, the username (admin), and be triggered when a logged-in user visits the page.