CVE-2019-13529 Cross-site request forgery in Sunny WebBox
An attacker can trick an authenticated operator into clicking a malicious link to perform unauthorized actions on the Sunny WebBox device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13529?
CVE-2019-13529 is a high-severity vulnerability in SMA Solar Technology AG Sunny WebBox, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
Weakness: CWE-352
Which versions are affected by CVE-2019-13529?
It affects 1 product.
Products include Sma Sunny Webbox Firmware.
How do I fix CVE-2019-13529?
No fix has been published for CVE-2019-13529 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13529 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-13529 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in SMA Solar Technology AG Sunny WebBox
Sources
Also known as GHSA-wgp7-3rwh-vpgw.