PT-2026-1441 · Fnip-4Xsh+1 · Fnip-4Xsh+1

Iej1Ctk1G · Published 2026-01-06 · Updated 2026-01-06 · CVE-2020-36906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions P5 FNIP-8x16A FNIP-4xSH version 1.0.20

Description The software contains a cross-site request forgery issue that enables attackers to execute administrative actions without authorization. An attacker can create malicious web pages to add new administrator accounts, alter passwords, and change system settings by deceiving authenticated users into loading a specially designed form. The attack relies on tricking a user who is already logged in to the application into performing actions they did not intend to.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing CSRF tokens to protect sensitive actions.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-36906

Affected Products

Fnip-4Xsh

P5 Fnip-8X16A

References · 9

• 🔥 https://packetstorm.news/files/id/157318 · Exploit
• 🔥 https://exploit-db.com/exploits/48362 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36906 · Security Note
• https://t.me/cveNotify/147859 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/180252 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/180253 · Note
• https://p5.hu · Note
• https://vulncheck.com/advisories/p-fnip-xa-fnip-xsh-cross-site-request-forgery-via-user-management · Note