PT-2021-23294 · Beeline · Beeline Smart Box

Pavel Stepanov · Published 2021-11-10 · Updated 2021-11-12 · CVE-2021-41426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beeline Smart box version 2.0.38

Description The issue is related to Cross Site Request Forgery (CSRF) via the "mgt end user.htm" page. This means an attacker could potentially trick a user into performing unintended actions on the Beeline Smart box.

Recommendations For Beeline Smart box version 2.0.38, as a temporary workaround, consider restricting access to the "mgt end user.htm" page until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-41426

Affected Products

Beeline Smart Box

References · 8

• 🔥 https://youtu.be/HL73yOW7YWU?t=540 · Exploit
• 🔥 https://youtu.be/WtcyIVImcwc · Exploit
• https://osv.dev/vulnerability/CVE-2021-41426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41426 · Security Note
• https://tula.beeline.ru/customers/pomosh/home/domashnij-internet/nastrojki-s-routerom/beelinesmartbox · Vendor Advisory
• https://t.me/cvenotify/23358 · Telegram Post
• https://t.me/cibsecurity/32162 · Telegram Post
• https://t.me/cvenotify/23236 · Telegram Post