High severity · published Dec 9, 2025
CVE-2021-47723
STVS ProVision Cross-Site Request Forgery (Add Admin)
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
STVS ProVision · STVS SA
5.9.10 (build 2885-3a8219a) · source: vendor
PR
Provision · Stvs
5.5; 5.6; 5.7; 5.8.6; 5.9.0; 5.9.1; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47723
Product
http://www.stvs.ch
Technical Description
https://www.exploit-db.com/exploits/49482
Third Party Advisory
https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php
More from STVS ProVision
6.5
CVE-2021-47724
STVS ProVision Authenticated File Disclosure via archive.rb
5.4
CVE-2021-47725
STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter