CVE-2007-4389 json
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51…
published 2007-08-17 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4372
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 1
- Exploit-DB
Summary
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks, via the NAME and ADDR parameters.
Timeline
- Published
- First public exploit (EDB-31013)
Exploit prediction
2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-31013 2WIRE Routers - Cross-Site Request Forgery remote, 2008-01-15
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:M/Au:N/C:N/I:P/A:C |
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/36044
vdb-entry
-
securityreason.com
/securityalert/3026
third-party-advisory
-
securityfocus.com
/archive/1/476595/100/0/threaded
mailing-list
-
securityfocus.com
/bid/27246
vdb-entry
- hakim.ws /2wire/demodns.html
Sources
- CVE List CVE-2007-4389
- NVD CVE-2007-4389
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.