CVE-2017-8337

CVE-2017-8337 describes a Cross-Site Request Forgery (CSRF) vulnerability in Securifi Almond, Almond+, and Almond 2015 devices running firmware AL-R096, stemming from a lack of Origin header validation. An attacker can trick a user into visiting a malicious webpage, enabling password brute-forcing for the web management interface and subsequent execution of administrative actions. This vulnerability carries a CVSSv3 score of 8.8 (HIGH), indicating a network-based attack with low complexity, requiring user interaction, and leading to high confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.