CVE-2013-7043 EXPLOIT
8.3
HIGH · CVSS 2.0 · EPSS 2% (pctl 80)
Patch early
A public exploit exists.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings, as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.
Scoring
| CVSS | 8.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:C |
| EPSS | 2.02% — more likely to be exploited than 80% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-12-10 |
| Last modified | 2026-06-17 |
Affected (4)
| Vendor | Product |
|---|---|
| cisco | scientific atlanta dpr\/epr2320 |
| cisco | scientific atlanta dpr\/epr2320 firmware |
| cisco | scientific atlanta dpr2325 |
| cisco | scientific atlanta dpr2325 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Scientific-Atlanta_ Inc. DPR2320R2 - Multiple Cross-Site Request Forgery Vulnerabilities | 2013-11-30 |
References
→ the Explorer · watch your stack · NVD