high8.8Public exploit code
CVE-2019-13529
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery2019-10-10 · webapps · hardware
Impact
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sma | Sunny Webbox Firmware | through 1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html
- https://www.us-cert.gov/ics/advisories/icsa-19-281-01
- http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html
- https://www.us-cert.gov/ics/advisories/icsa-19-281-01
- https://packetstorm.news/files/id/154789