CVE:CVE-2014-8654
CNNVD:CNNVD-201411-189
Compal Broadband Networks（CBN）CH6640E和CG6640E Wireless Gateway都是Compal Broadband Networks公司的无线网关产品。
使用CH6640-3.5.11.7-NOSH版本固件的CBN CH6640E和CG6640E Wireless Gateway 1.0版本中存在跨站请求伪造漏洞。远程攻击者可借助setWirelessSecurity.html页面中的‘psKey’参数利用该漏洞更改Wifi密码；可借助setBasicDHCP1.html页面的add_static操作中的‘MacAddress’参数利用该漏洞添加静态的MAC地址；可通过setAdvancedOptions.html页面的apply操作中的‘UPnP’参数利用该漏洞启用或禁用UPnP。
solution:Upgrade compal_broadband_networks firmware to a higher version than ch6640-3.5.11.7-nosh,and avoid the version ch6640-3.5.11.7-nosh; Upgrade compal_broadband_networks cg6640e_wireless_gateway to a higher version than 1.0,and avoid the version 1.0; Upgrade compal_broadband_networks ch664oe_wireless_gateway to a higher version than 1.0,and avoid the version 1.0