CVE-2020-21884
HIGHUniBox U50/U500/U1000/U2500/U5000 Firmware 2.4 - Cross-Site Request Forgery in Network Trace and User Listing Endpoints
Title source: llmDescription
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
http://wifi-soft.com
Mailing List x_refsource_misc
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg07139.html
Exploit, Third Party Advisory
https://s3curityb3ast.github.io/KSA-Dev-008.txt
Scores
CVSS v3
8.8
EPSS
0.0119
EPSS Percentile
64.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (5)
indionetworks/unibox_u1000_firmware
2.4
indionetworks/unibox_u2500_firmware
2.4
indionetworks/unibox_u5000_firmware
2.4
indionetworks/unibox_u500_firmware
2.4
indionetworks/unibox_u50_firmware
2.4
Published
Apr 09, 2021
Tracked Since
Feb 18, 2026