CVE-2020-21884
High
Description
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.
SeverityHigh
CVSS8.8
Exploit probability—
ProductIndionetworks Unibox U50 Firmware
PublishedApr 9, 2021
First seenApr 9, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| indionetworks unibox_u50_firmware | 2.4 | — |
| indionetworks unibox_u500_firmware | 2.4 | — |
| indionetworks unibox_u1000_firmware | 2.4 | — |
| indionetworks unibox_u2500_firmware | 2.4 | — |
| indionetworks unibox_u5000_firmware | 2.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.