CVE-2020-27692 Cross-site request forgery in n/a
Cross-site request forgery in the web portal allows attackers to modify TR-069 settings, enabling remote reboots or malicious firmware uploads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-27692?
CVE-2020-27692 is a high-severity vulnerability in n/a, published on 4 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (responsible for managing devices remotely). This makes it possible to remotely reboot the device or upload malicious firmware.
Weakness: CWE-352
Which versions are affected by CVE-2020-27692?
It affects 1 product.
Products include Imomobile Verve Connect Vh510 Firmware.
How do I fix CVE-2020-27692?
No fix has been published for CVE-2020-27692 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27692 being exploited?
There is no known exploitation of CVE-2020-27692 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-66ww-763p-x3j2.