High severity · published Oct 9, 2019
CVE-2019-13529
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox…
8.8
CVSS
3.1%
EPSS
No
On KEV
Description
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Sunny Webbox Firmware · Sma
through 1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13529
Third Party Advisory
http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-281-01
packetstorm.news
https://packetstorm.news/files/id/154789
More from Sunny Webbox Firmware
5.4
CVE-2024-1890
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox…