Junglewise Threat Intelligence

CVE-2020-10181: Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability

CVE-2020-10181 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

Executive brief

Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability in the goform/formEMR30 endpoint. An attacker can exploit this to create arbitrary users with administrator privileges by sending a crafted setString request.

Affected products

  • Sumavision Enhanced Multimedia Router (EMR) firmware 3.0.4.27

Timeline

  • 2020-03-11: disclosed: NVD Published Date
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2021-11-03: advisory: Published date listed in advisory header