PT-2020-15890 · Genexis · Genexis Platinum 4410 V2

Jinson Varghese Behanan · Published 2020-09-16 · Updated 2022-11-16 · CVE-2020-25015

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Genexis Platinum 4410 V2 version 2.1 (software version P4410-V2-1.28)

Description The issue allows for changing the Wi-Fi password remotely due to Broken Access Control and CSRF. This could potentially be exploited to gain unauthorized access to the Wi-Fi network.

Recommendations For Genexis Platinum 4410 V2 version 2.1 (software version P4410-V2-1.28), as a temporary workaround, consider disabling remote access to the router's configuration until a patch is available. Restrict access to the router's web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-25015

Affected Products

Genexis Platinum 4410 V2

References · 7

• 🔥 https://exploit-db.com/exploits/49000 · Exploit
• 🔥 https://jinsonvarghese.com/broken-access-control-csrf-in-genexis-platinum-4410 · Exploit
• 🔥 https://getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410 · Exploit
• 🔥 http://packetstormsecurity.com/files/159936/Genexis-Platinum-4410-P4410-V2-1.28-Missing-Access-Control-CSRF.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25015 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25015 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2070 · Telegram Post