CVE-2017-8334: Securifi Almond+firmware

High severity, CVSS 8.0. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.

Affected products

• Securifi Almond+firmware: version al-r096 only
• Securifi Almond 2015 Firmware: version al-r096 only
• Securifi Almond Firmware: version al-r096 only

Published 2019-06-18. Last modified 2026-06-17.