Cross-Site Request Forgery in Sunny WebBox Firmware by SMA Solar Technology AG
CVE-2019-13529

8.8HIGH

Key Information:

Vendor

Sma Solar Technology Ag

Status
Sunny Webbox
Vendor
CVE Published:
9 October 2019

What is CVE-2019-13529?

The Sunny WebBox Firmware versions prior to 1.6 are susceptible to a Cross-Site Request Forgery vulnerability. Authenticated users may inadvertently be tricked into clicking a malicious link, which can allow attackers to execute unauthorized actions that leverage the user's permissions. This issue is exacerbated by the device's reliance on IP addresses for session management after login, simplifying the attack process. Users are advised to apply patches and follow security best practices to mitigate this vulnerability.

Affected Version(s)

Sunny WebBox Firmware Version 1.6 and prior

References

https://www.us-cert.gov/ics/advisories/icsa-19-281-01
x_refsource_MISC
http://packetstormsecurity.com/files/154789/SMA-Solar-Tec...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.