Devolo dLAN 500 AV Wireless+ Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in the Devolo dLAN 500 AV Wireless+ version 3.1.0-1. This vulnerability allows attackers to perform administrative actions without proper request validation. By exploiting predictable URL actions, attackers can craft malicious web pages that trigger unauthorized configuration changes when a logged-in user visits the site.

Impact

Exploitation of this vulnerability allows for cross-site request forgery, enabling unauthorized administrative actions to be performed on behalf of a logged-in user.

Reproduction

To reproduce this vulnerability, a logged-in user must be tricked into visiting a malicious website that exploits the CSRF vulnerability. The malicious site can be crafted to send a POST request to the Devolo device's web management interface, using the predictable URL actions that the application does not validate. The request can include administrative commands, such as changing network time protocol (NTP) settings, which the device will execute without verification.