CVE-2020-23592

HIGH

OPTILINK OP-XT71000N V2.2 Firmware OP_V3.3.1-191028 - Unauthenticated Cross-Site Request Forgery via mgm_dev_reset.asp

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-23592. PoCs published by huzaifahussain98.

AI-analyzed exploit summary This repository describes a CSRF vulnerability in OPTILINK OP-XT71000N devices that allows unauthenticated remote attackers to reset the device to factory defaults, leading to privilege escalation via default credentials. The attack vector targets the '/mgm_dev_reset.asp' endpoint.

Description

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.

Exploits (1)

nomisec WRITEUP

by huzaifahussain98 · poc

https://github.com/huzaifahussain98/CVE-2020-23592

View Code ZIP pw:eip

This repository describes a CSRF vulnerability in OPTILINK OP-XT71000N devices that allows unauthenticated remote attackers to reset the device to factory defaults, leading to privilege escalation via default credentials. The attack vector targets the '/mgm_dev_reset.asp' endpoint.

Classification

Writeup 90%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028

No auth needed

Prerequisites: Network access to the vulnerable device · Victim interaction for CSRF attack

MITRE ATT&CK

T1189 - Drive-by Compromise T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Third Party Advisory

https://github.com/huzaifahussain98/CVE-2020-23592

Scores

CVSS v3 8.8

EPSS 0.0053

EPSS Percentile 40.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

optilinknetwork/op-xt71000n_firmware 3.3.1-191028

Published Nov 23, 2022

Tracked Since Feb 18, 2026