CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
85.9%
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of executing various actions on the web management interface. It seems that the device does not implement any Origin header check which allows an attacker who can trick a user to navigate to an attacker’s webpage to exploit this issue and brute force the password for the web management interface. It also allows an attacker to then execute any other actions which include management if rules, sensors attached to the devices using the websocket requests.
Vendor | Product | Version | CPE |
---|---|---|---|
securifi | almond_2015_firmware | al-r096 | cpe:2.3:o:securifi:almond_2015_firmware:al-r096:*:*:*:*:*:*:* |
securifi | almond_2015 | - | cpe:2.3:h:securifi:almond_2015:-:*:*:*:*:*:*:* |
securifi | almond\+firmware | al-r096 | cpe:2.3:o:securifi:almond\+firmware:al-r096:*:*:*:*:*:*:* |
securifi | almond\+ | - | cpe:2.3:h:securifi:almond\+:-:*:*:*:*:*:*:* |
securifi | almond_firmware | al-r096 | cpe:2.3:o:securifi:almond_firmware:al-r096:*:*:*:*:*:*:* |
securifi | almond | - | cpe:2.3:h:securifi:almond:-:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
85.9%