What’s Vulnerable › Vulnerabilities

CVE-2016-4845

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-09-24 · updated 2026-06-17
• Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.

Affected products

• Iodata Hvl-A2.0 Firmware: 2.03
• Iodata Hvl-A3.0 Firmware: 2.03
• Iodata Hvl-A4.0 Firmware: 2.03
• Iodata Hvl-At1.0S Firmware: 2.03
• Iodata Hvl-At2.0 Firmware: 2.03
• Iodata Hvl-At2.0A Firmware: 2.03
• Iodata Hvl-At3.0 Firmware: 2.03
• Iodata Hvl-At3.0A Firmware: 2.03
• Iodata Hvl-At4.0 Firmware: 2.03
• Iodata Hvl-At4.0A Firmware: 2.03

References

• http://jvn.jp/en/jp/JVN35062083/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000134
• http://www.iodata.jp/support/information/2016/hvl-a_csrf/
• http://www.securityfocus.com/bid/92352
• http://jvn.jp/en/jp/JVN35062083/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000134
• http://www.iodata.jp/support/information/2016/hvl-a_csrf/
• http://www.securityfocus.com/bid/92352

Get alerted when CVE-2016-4845 or the next vulnerability affects your stack