PT-2022-8680 · Optilink · Optilink Op-Xt71000N

Disguised_Noob + 1 · Published 2022-11-23 · Updated 2025-04-25 · CVE-2020-23587

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028

Description A vulnerability allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack, enabling a man-in-the-middle attack by adding new routes in RoutingConfiguration on the "/routing.asp" API endpoint. This issue can be exploited to intercept and manipulate traffic.

Recommendations For OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028, consider disabling access to the "/routing.asp" API endpoint until a patch is available to prevent the addition of new routes in RoutingConfiguration. Restricting access to the RoutingConfiguration feature can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-23587

Affected Products

Optilink Op-Xt71000N

References · 6

• 🔥 https://github.com/huzaifahussain98/CVE-2020-23587 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23587 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23587 · Vendor Advisory
• https://t.me/cvenotify/38289 · Telegram Post
• https://t.me/cibsecurity/53387 · Telegram Post
• https://t.me/cvenotify/119883 · Telegram Post