Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by kasda
VAR-201509-0226
Vulnerability from variot - Updated: 2023-12-18 12:38Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. PLDT SpeedSurf 504AN and Kasda KW58293 incorrectly use the form2ping.cgi page to send PING requests, allowing remote attackers to submit special \342\200\230ipaddr\342\200\231 parameters for denial of service attacks. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd. There is a buffer overflow vulnerability in the form2ping.cgi file of PLDT SpeedSurf 504AN device and Kasda KW58293 using GAN9.8U26-4-TX-R6B018-PH.EN firmware
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201509-0226",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": "gan9.8u26-4-tx-r6b018-hp.en"
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "none"
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "firmware"
},
{
"model": "speedsurf 504an",
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": null
},
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": "gan9.8u26-4-tx-r6b018-ph.en"
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b018-ph.en",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b01",
"scope": null,
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "BID",
"id": "76526"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:philippine_long_distance_telephone:speedsurf_504an_firmware:gan9.8u26-4-tx-r6b018-hp.en:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:speedsurf_504an:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5993"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Eskie Cirrus James Maquilang",
"sources": [
{
"db": "BID",
"id": "76526"
}
],
"trust": 0.3
},
"cve": "CVE-2015-5993",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.8,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2015-5993",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-06098",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-83954",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-5993",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-06098",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201509-216",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-83954",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "VULHUB",
"id": "VHN-83954"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. PLDT SpeedSurf 504AN and Kasda KW58293 incorrectly use the form2ping.cgi page to send PING requests, allowing remote attackers to submit special \\342\\200\\230ipaddr\\342\\200\\231 parameters for denial of service attacks. \nAttackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd. There is a buffer overflow vulnerability in the form2ping.cgi file of PLDT SpeedSurf 504AN device and Kasda KW58293 using GAN9.8U26-4-TX-R6B018-PH.EN firmware",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "BID",
"id": "76526"
},
{
"db": "VULHUB",
"id": "VHN-83954"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-5993",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVNVU98946427",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-06098",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216",
"trust": 0.6
},
{
"db": "BID",
"id": "76526",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-83954",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "VULHUB",
"id": "VHN-83954"
},
{
"db": "BID",
"id": "76526"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"id": "VAR-201509-0226",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "VULHUB",
"id": "VHN-83954"
}
],
"trust": 1.30416665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06098"
}
]
},
"last_update_date": "2023-12-18T12:38:22.421000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "KW58293",
"trust": 0.8,
"url": "http://www.kasda.cn/product_info.asp?id=232"
},
{
"title": "PLDT - Philippine Long Distance Telephone Company",
"trust": 0.8,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83954"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.kb.cert.org/vuls/id/525276"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5993"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu98946427/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5993"
},
{
"trust": 0.3,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "VULHUB",
"id": "VHN-83954"
},
{
"db": "BID",
"id": "76526"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"db": "VULHUB",
"id": "VHN-83954"
},
{
"db": "BID",
"id": "76526"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-31T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"date": "2015-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-83954"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76526"
},
{
"date": "2015-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"date": "2015-09-21T10:59:08.630000",
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"date": "2015-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-04-17T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06098"
},
{
"date": "2015-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-83954"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76526"
},
{
"date": "2015-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004949"
},
{
"date": "2015-09-21T15:52:08.863000",
"db": "NVD",
"id": "CVE-2015-5993"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Philippine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-216"
}
],
"trust": 0.6
}
}
VAR-201509-0225
Vulnerability from variot - Updated: 2023-12-18 12:38Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi pages fail to adequately filter the \342\200\230ssid\342\200\231 parameter, allowing remote attackers to exploit the vulnerability to inject malicious scripts or HTML code to obtain sensitive information or hijack user sessions when malicious data is viewed. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd. There is a cross-site scripting vulnerability in the form2WlanSetup.cgi file of PLDT SpeedSurf 504AN devices and Kasda KW58293 using GAN9.8U26-4-TX-R6B018-PH.EN firmware
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201509-0225",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": "gan9.8u26-4-tx-r6b018-hp.en"
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "none"
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "firmware"
},
{
"model": "speedsurf 504an",
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": null
},
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": "gan9.8u26-4-tx-r6b018-ph.en"
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b018-ph.en",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b01",
"scope": null,
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "BID",
"id": "76516"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:philippine_long_distance_telephone:speedsurf_504an_firmware:gan9.8u26-4-tx-r6b018-hp.en:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:speedsurf_504an:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5992"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Eskie Cirrus James Maquilang",
"sources": [
{
"db": "BID",
"id": "76516"
}
],
"trust": 0.3
},
"cve": "CVE-2015-5992",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2015-5992",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2015-06099",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-83953",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-5992",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2015-06099",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201509-215",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-83953",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "VULHUB",
"id": "VHN-83953"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi pages fail to adequately filter the \\342\\200\\230ssid\\342\\200\\231 parameter, allowing remote attackers to exploit the vulnerability to inject malicious scripts or HTML code to obtain sensitive information or hijack user sessions when malicious data is viewed. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd. There is a cross-site scripting vulnerability in the form2WlanSetup.cgi file of PLDT SpeedSurf 504AN devices and Kasda KW58293 using GAN9.8U26-4-TX-R6B018-PH.EN firmware",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "BID",
"id": "76516"
},
{
"db": "VULHUB",
"id": "VHN-83953"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-5992",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVNVU98946427",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-06099",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215",
"trust": 0.6
},
{
"db": "BID",
"id": "76516",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-83953",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "VULHUB",
"id": "VHN-83953"
},
{
"db": "BID",
"id": "76516"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"id": "VAR-201509-0225",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "VULHUB",
"id": "VHN-83953"
}
],
"trust": 1.30416665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06099"
}
]
},
"last_update_date": "2023-12-18T12:38:19.154000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "KW58293",
"trust": 0.8,
"url": "http://www.kasda.cn/product_info.asp?id=232"
},
{
"title": "PLDT - Philippine Long Distance Telephone Company",
"trust": 0.8,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83953"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.kb.cert.org/vuls/id/525276"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5992"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu98946427/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5992"
},
{
"trust": 0.3,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "VULHUB",
"id": "VHN-83953"
},
{
"db": "BID",
"id": "76516"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "VULHUB",
"id": "VHN-83953"
},
{
"db": "BID",
"id": "76516"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-31T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"date": "2015-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-83953"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76516"
},
{
"date": "2015-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"date": "2015-09-21T10:59:07.663000",
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"date": "2015-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-04-17T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"date": "2015-09-22T00:00:00",
"db": "VULHUB",
"id": "VHN-83953"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76516"
},
{
"date": "2015-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004950"
},
{
"date": "2015-09-22T01:40:59.437000",
"db": "NVD",
"id": "CVE-2015-5992"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Phillipine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06099"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-215"
}
],
"trust": 0.6
}
}
VAR-201509-0224
Vulnerability from variot - Updated: 2023-12-18 12:38Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi pages fail to perform authentication correctly, allowing remote attackers to build malicious URIs, entice users to resolve, and perform malicious actions in the target user context. This may aid in other attacks. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201509-0224",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": "gan9.8u26-4-tx-r6b018-hp.en"
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 1.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "none"
},
{
"model": "kw58293",
"scope": "eq",
"trust": 0.8,
"vendor": "kasda",
"version": "firmware"
},
{
"model": "speedsurf 504an",
"scope": null,
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": null
},
{
"model": "speedsurf 504an",
"scope": "eq",
"trust": 0.8,
"vendor": "philippine long distance telephone pldt",
"version": "gan9.8u26-4-tx-r6b018-ph.en"
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b018-ph.en",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": null,
"trust": 0.6,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "speedsurf 504an gan9.8u26-4-tx-r6b01",
"scope": null,
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": null
},
{
"model": "kasda kw58293",
"scope": "eq",
"trust": 0.3,
"vendor": "philippine long distance telephone",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "BID",
"id": "76527"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:philippine_long_distance_telephone:speedsurf_504an_firmware:gan9.8u26-4-tx-r6b018-hp.en:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:speedsurf_504an:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:philippine_long_distance_telephone:kasda_kw58293:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5991"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Eskie Cirrus James Maquilang",
"sources": [
{
"db": "BID",
"id": "76527"
}
],
"trust": 0.3
},
"cve": "CVE-2015-5991",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2015-5991",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2015-06101",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-83952",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-5991",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2015-06101",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201509-214",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-83952",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "VULHUB",
"id": "VHN-83952"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings. The Phillipine Long Distance Telephone (PLDT) company provides internet access in the Phillippines. The SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT contain multiple vulnerabilities. The BaudTec ADSL2+ Router may also be affected. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi pages fail to perform authentication correctly, allowing remote attackers to build malicious URIs, entice users to resolve, and perform malicious actions in the target user context. This may aid in other attacks. The former is a product of the Philippine PLDT company. The latter is a product of China Hongcheng (Kasda) Digital Technology Co., Ltd",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "BID",
"id": "76527"
},
{
"db": "VULHUB",
"id": "VHN-83952"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-5991",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVNVU98946427",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06101",
"trust": 0.6
},
{
"db": "BID",
"id": "76527",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-83952",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "VULHUB",
"id": "VHN-83952"
},
{
"db": "BID",
"id": "76527"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"id": "VAR-201509-0224",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "VULHUB",
"id": "VHN-83952"
}
],
"trust": 1.30416665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06101"
}
]
},
"last_update_date": "2023-12-18T12:38:19.110000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "KW58293",
"trust": 0.8,
"url": "http://www.kasda.cn/product_info.asp?id=232"
},
{
"title": "PLDT - Philippine Long Distance Telephone Company",
"trust": 0.8,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83952"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.kb.cert.org/vuls/id/525276"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5991"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu98946427/index.html"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5991"
},
{
"trust": 0.3,
"url": "http://www.pldt.com/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "VULHUB",
"id": "VHN-83952"
},
{
"db": "BID",
"id": "76527"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#525276"
},
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "VULHUB",
"id": "VHN-83952"
},
{
"db": "BID",
"id": "76527"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-31T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"date": "2015-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-83952"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76527"
},
{
"date": "2015-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"date": "2015-09-21T10:59:06.553000",
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"date": "2015-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-04-17T00:00:00",
"db": "CERT/CC",
"id": "VU#525276"
},
{
"date": "2015-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"date": "2015-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-83952"
},
{
"date": "2015-08-31T00:00:00",
"db": "BID",
"id": "76527"
},
{
"date": "2015-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004730"
},
{
"date": "2015-09-21T19:55:16.240000",
"db": "NVD",
"id": "CVE-2015-5991"
},
{
"date": "2015-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Phillipine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06101"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-214"
}
],
"trust": 0.6
}
}