high8.8
CVE-2020-21884
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace,…
Impact
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Indionetworks | Unibox U50 Firmware | Version 2.4 |
| Indionetworks | Unibox U500 Firmware | Version 2.4 |
| Indionetworks | Unibox U1000 Firmware | Version 2.4 |
| Indionetworks | Unibox U2500 Firmware | Version 2.4 |
| Indionetworks | Unibox U5000 Firmware | Version 2.4 |