PT-2019-3961 · Sma Solar Technology · Sunny Webbox Firmware

Borja Merino + 3 · Publicado 2019-10-08 · Atualizado 2019-10-15 · CVE-2019-13529

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sunny WebBox Firmware versions 1.6 and prior

Description The issue allows remote attackers to perform actions with the permissions of the user. This can be achieved by sending a malicious link to an authenticated operator. The device's use of IP addresses to maintain communication after a successful login increases the ease of exploitation. The vulnerability is related to cross-site request forgery, which may allow a remote attacker to elevate their privileges using a specially crafted malicious link.

Recommendations For Sunny WebBox Firmware versions 1.6 and prior, consider restricting access to the device to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid clicking on links from untrusted sources while logged in to the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2019-04477

CVE-2019-13529

Produtos afetados

Sunny Webbox Firmware

Referências · 6

• 🔥 https://exploit-db.com/exploits/47480 · Exploit
• https://bdu.fstec.ru/vul/2019-04477 · Nota de Segurança
• http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html · Nota
• https://us-cert.gov/ics/advisories/icsa-19-281-01 · Nota
• https://osv.dev/vulnerability/CVE-2019-13529 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13529 · Nota de Segurança