CVEvulnerability
CVE-2019-13529
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-10-09
- Last modified
- 2026-07-13
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
Affected configurations
• sma sunny webbox firmware (<= 1.6)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-281-01 Third Party Advisory, US Government Resource
- http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-281-01 Third Party Advisory, US Government Resource
- https://packetstorm.news/files/id/154789 packetstorm.news