PT-2020-13400 · Rad · Rad Secflow-1V

Jonatan Schor + 1 · Published 2020-09-16 · Updated 2020-09-22 · CVE-2020-13259

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RAD SecFlow-1v os-image version SF 0290 2.3.01.26

Description The issue is related to insufficient CSRF protections for the web UI on an affected device, allowing an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. An attacker could exploit this by persuading a user of the interface to follow a malicious link, potentially allowing the attacker to perform arbitrary actions with the privilege level of the affected user.

Recommendations For RAD SecFlow-1v os-image version SF 0290 2.3.01.26, consider implementing additional CSRF protections for the web UI to prevent exploitation. As a temporary workaround, restrict access to the web-based management interface to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-13259

Affected Products

Rad Secflow-1V

References · 5

• 🔥 https://github.com/UrielYochpaz/CVE-2020-13259 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2020090064 · Exploit
• 🔥 https://exploit-db.com/exploits/48809 · Exploit
• https://osv.dev/vulnerability/CVE-2020-13259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13259 · Security Note