CVE-2016-4845: Iodata Hvl-a2.0 Firmware

High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.

Affected products

• Iodata Hvl-a2.0 Firmware: version 2.03 only
• Iodata Hvl-a3.0 Firmware: version 2.03 only
• Iodata Hvl-a4.0 Firmware: version 2.03 only
• Iodata Hvl-AT1.0S Firmware: version 2.03 only
• Iodata Hvl-AT2.0 Firmware: version 2.03 only
• Iodata Hvl-AT2.0A Firmware: version 2.03 only
• Iodata Hvl-AT3.0 Firmware: version 2.03 only
• Iodata Hvl-AT3.0A Firmware: version 2.03 only
• Iodata Hvl-AT4.0 Firmware: version 2.03 only
• Iodata Hvl-AT4.0A Firmware: version 2.03 only

Published 2016-09-24. Last modified 2026-06-17.