PT-2019-3961 · Sma Solar Technology · Sunny Webbox Firmware

Borja Merino + 3 · Published 2019-10-08 · Updated 2019-10-15 · CVE-2019-13529

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sunny WebBox Firmware versions 1.6 and prior

Description The issue allows remote attackers to perform actions with the permissions of the user. This can be achieved by sending a malicious link to an authenticated operator. The device's use of IP addresses to maintain communication after a successful login increases the ease of exploitation. The vulnerability is related to cross-site request forgery, which may allow a remote attacker to elevate their privileges using a specially crafted malicious link.

Recommendations For Sunny WebBox Firmware versions 1.6 and prior, consider restricting access to the device to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid clicking on links from untrusted sources while logged in to the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2019-04477

CVE-2019-13529

Affected Products

Sunny Webbox Firmware

References · 6

• 🔥 https://exploit-db.com/exploits/47480 · Exploit
• https://bdu.fstec.ru/vul/2019-04477 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13529 · Security Note
• http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html · Note
• https://us-cert.gov/ics/advisories/icsa-19-281-01 · Note