What is the CVSS score of CVE-2013-7043?

CVE-2013-7043 has a CVSS 2.0 base score of 8.3 (High). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:C. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for CVE-2013-7043?

Yes, a public proof-of-concept exploit is available for CVE-2013-7043. Prioritise patching immediately. EPSS: 0.8%.

Scientific Atlanta Dpr Epr2320 Firmware CVE-2013-7043

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2013-12-10 cve@mitre.org

CSRF Cisco Scientific Atlanta Dpr Epr2320 Firmware Scientific Atlanta Dpr Epr2320 Scientific Atlanta Dpr2325 Firmware Scientific Atlanta Dpr2325

8.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:M/Au:N/C:P/I:P/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 10, 2013 - 19:55 cve.org

HIGH 8.3

DescriptionCVE.org

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.

AnalysisAI

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic. Affected products include: Cisco Scientific Atlanta Dpr\/Epr2320 Firmware, Cisco Scientific Atlanta Dpr\/Epr2320, Cisco Scientific Atlanta Dpr2325 Firmware, Cisco Scientific Atlanta Dpr2325.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.