The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-264,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dlink | di-604s | - |
| alphanetworks | vdsl_asl-55052 | - |
| dlink | tm-g5240 | - |
| planex | brl-04r | - |
| dlink | dir-100 | - |
| dlink | di-624s | - |
| planex | brl-04cw | - |
| dlink | di-524up | - |
| dlink | dir-120 | - |
| dlink | di-604+ | - |
| dlink | di-604up | - |
| alphanetworks | vdsl_asl-56552 | - |
| planex | brl-04ur | - |