CVE:CVE-2010-4507
CNNVD:CNNVD-201012-370
ISpot 2.0.0.0 R1679，ClearSpot 2.0.0.0 R1512和R1786版本中存在多个跨站请求伪造漏洞。远程攻击者可以利用这些漏洞劫持管理员认证来获得以下请求：(1)借助对webmain.cgi文件的act_cmd_result操作中的cmd参数执行任意命令的请求;(2)借助对ebmain.cgi文件的enable_remote_access act_network_set操作启动远程管理的请求;(3)借助向webmain.cgi文件的ENABLE_TELNET act_set_wimax_etc_config操作启动TELNET服务的请求;(4)借助对webmain.cgi文件的act_network_set操作启动TELNET会话的请求;(5)借助向upgrademain.cgi文件的act_file_download操作中的FILE_PATH参数读取任意文件的请求。
solution:Upgrade clear ispot_firmware to a higher version than 1.9.9.4,and avoid the version 1.9.9.4; Upgrade clear ispot to a higher version than 2.0.0.0:r1679,and avoid the version 2.0.0.0:r1679; Upgrade clear clearspot_firmware to a higher version than 1.9.9.4,and avoid the version 1.9.9.4; Upgrade clear clearspot to a higher version than 2.0.0.0:r1512,2.0.0.0:r1786,and avoid the version 2.0.0.0:r1512,2.0.0.0:r1786