TI-2016-04188 Aliases CVE-2016-4845 GHSA-f4m6-6rf4-xgc8

Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0…

MEDIUM 43CWE-352Published 2016-09-24 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.

Why it matters now

EPSS 0.02385 84th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:o:iodata:hvl-a2.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-a3.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-a4.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at1.0s_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at2.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at2.0a_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at3.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at3.0a_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at4.0_firmware:2.03:::::::*	2.03	Vulnerable	Iodata
cpe:2.3:o:iodata:hvl-at4.0a_firmware:2.03:::::::*	2.03	Vulnerable	Iodata

cpe:2.3:o:iodata:hvl-a2.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-a3.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-a4.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at1.0s_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at2.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at2.0a_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at3.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at3.0a_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at4.0_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata
cpe:2.3:o:iodata:hvl-at4.0a_firmware:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Iodata

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:h:iodata:hvl-a:-:::::::*	not specified by NVD	Running on	Iodata
cpe:2.3:h:iodata:hvl-at:-:::::::*	not specified by NVD	Running on	Iodata
cpe:2.3:h:iodata:hvl-ata:-:::::::*	not specified by NVD	Running on	Iodata

cpe:2.3:h:iodata:hvl-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
cpe:2.3:h:iodata:hvl-at:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
cpe:2.3:h:iodata:hvl-ata:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-4845
2026-10-03 Alias added: GHSA-f4m6-6rf4-xgc8

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences