PT-2020-14808 · N Tron · N-Tron 702-W+1

Published 2020-09-01 · Updated 2020-09-08 · CVE-2020-16208

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions N-Tron 702-W / 702M12-W (all versions)

Description The issue allows an attacker to perform cross-site request forgery, potentially enabling them to modify different device configurations. This can be achieved by luring an authenticated user into clicking a crafted link.

Recommendations For all versions, consider implementing measures to prevent cross-site request forgery attacks, such as validating request origins or using anti-CSRF tokens, until a specific fix is provided.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-16208

Affected Products

N-Tron 702-W

N-Tron 702M12-W

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-16208 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01 · Note
• http://seclists.org/fulldisclosure/2020/Sep/6 · Note
• http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html · Note