cyfenced.com →

[ CVE-2020-10181 · Published 11 Mar 2020 ]

Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 15%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
  • EPSS: 15% chance of exploitation in the next 30 days (higher than 97% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.

CISA: Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References