Description
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
Exploits (1)
exploitdb
WORKING POC
by Borja Merino · textwebappshardware
https://www.exploit-db.com/exploits/47480
Scores
CVSS v3
8.8
EPSS
0.0015
EPSS Percentile
35.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
sma/sunny_webbox_firmware
< 1.6
Published
Oct 09, 2019
Tracked Since
Feb 18, 2026