What is the CVSS score of CVE-2013-0126?

CVE-2013-0126 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.9%.

Is there a public PoC exploit available for CVE-2013-0126?

Yes, a public proof-of-concept exploit is available for CVE-2013-0126. Prioritise patching immediately. EPSS: 0.9%.

Fios Actiontec Mi424Wr Gen31 Router Firmware CVE-2013-0126

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2013-03-21 cret@cert.org

CSRF Fios Actiontec Mi424Wr Gen31 Router Firmware Fios Actiontec Mi424Wr Gen31 Router

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Mar 21, 2013 - 20:55 cve.org

MEDIUM 6.8

DescriptionCVE.org

Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.

AnalysisAI

Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters. Affected products include: Verizon Fios Actiontec Mi424Wr-Gen31 Router Firmware, Verizon Fios Actiontec Mi424Wr-Gen31 Router.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.