CVE-2015-2805: Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the manag...

Security readout for executives and security teams

This vulnerability lets an attacker abuse a logged-in OmniSwitch administrator’s browser to create a local user through the switch web management interface. The attacker still needs the administrator to be authenticated and interact with attacker-controlled content, but success could create unauthorized management access on network infrastructure. Exposure is most likely where affected OmniSwitch models run the named firmware versions and the web management interface is enabled, reachable, and used by administrators. Internet exposure would increase urgency, but the sources do not state how commonly exposed these interfaces are. Treat this as high priority for environments using affected OmniSwitch web management. The business concern is unauthorized administrative access to switching infrastructure, especially if management interfaces are broadly reachable or administrators routinely manage devices from general-use workstations. Mitigation focus: Check Alcatel-Lucent or successor vendor guidance for fixed firmware or official mitigations.; Restrict web management access to trusted management networks or VPN paths.; Disable web management if it is not operationally required..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.