PT-2026-1441 · Fnip-4Xsh+1 · Fnip-4Xsh+1

Iej1Ctk1G · Publicado 2026-01-06 · Atualizado 2026-01-06 · CVE-2020-36906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions P5 FNIP-8x16A FNIP-4xSH version 1.0.20

Description The software contains a cross-site request forgery issue that enables attackers to execute administrative actions without authorization. An attacker can create malicious web pages to add new administrator accounts, alter passwords, and change system settings by deceiving authenticated users into loading a specially designed form. The attack relies on tricking a user who is already logged in to the application into performing actions they did not intend to.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing CSRF tokens to protect sensitive actions.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2020-36906

Produtos afetados

Fnip-4Xsh

P5 Fnip-8X16A

Referências · 9

• 🔥 https://packetstorm.news/files/id/157318 · Exploit
• 🔥 https://exploit-db.com/exploits/48362 · Exploit
• https://t.me/cveNotify/147859 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/180252 · Nota
• https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36906 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/180253 · Nota
• https://p5.hu · Nota
• https://vulncheck.com/advisories/p-fnip-xa-fnip-xsh-cross-site-request-forgery-via-user-management · Nota