CVE-2020-10181
CVE-2020-10181
In short
A vulnerability in Sumavision Enhanced Multimedia Router allows attackers to create new administrator accounts without authentication, giving them complete control of the device.
Technical detail
CWE-352 (CSRF/missing authorization) in goform/formEMR30 endpoint permits unauthenticated user creation with administrator privileges via crafted setString parameter. No authentication or CSRF tokens are validated, allowing remote attackers to establish persistent administrative access to the router.
Summary generated and translated by AI from the official description.
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 1
cve_referencepacketstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →