CVE-2020-10181
📋 TL;DR
This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 that allows attackers to create arbitrary administrator accounts on affected devices. Attackers can trick authenticated users into executing malicious requests that create new privileged accounts. This affects organizations using Sumavision EMR 3.0.4.27 devices.
💻 Affected Systems
- Sumavision Enhanced Multimedia Router (EMR)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with attacker gaining administrative access, enabling network interception, configuration changes, and potential lateral movement to connected systems.
Likely Case
Unauthorized administrative account creation leading to persistent access, data exfiltration, and device manipulation.
If Mitigated
Limited impact with proper CSRF protections, network segmentation, and monitoring in place.
🎯 Exploit Status
Exploit requires victim to be authenticated to the router's web interface and visit a malicious page. The exploit is simple and well-documented in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider replacing affected devices.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all form submissions in the web interface
Network Segmentation
allIsolate EMR devices from internet and restrict access to management interface
🧯 If You Can't Patch
- Deploy network-based CSRF protection using web application firewalls
- Implement strict access controls and monitor for unauthorized user creation
🔍 How to Verify
Check if Vulnerable:
Check if device is running Sumavision EMR 3.0.4.27 via web interface or console. Test by attempting CSRF attack with proof-of-concept code.Check Version:
Check web interface login page or system information page for version detailsVerify Fix Applied:
Verify CSRF tokens are required for form submissions and test that unauthorized user creation is prevented.📡 Detection & Monitoring
Log Indicators:
- Unexpected user creation events
- Administrator account creation from unusual IP addresses
- Multiple failed login attempts followed by new user creation
Network Indicators:
- POST requests to /goform/formEMR30 with setString parameter
- Requests containing 'new_user<*1*>administrator' pattern
SIEM Query:
source="router_logs" AND (event="user_created" OR uri="/goform/formEMR30")🔗 References
- http://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.html
- https://github.com/s1kr10s/Sumavision_EMR3.0
- https://www.youtube.com/watch?v=Ufcj4D9eA5o
- http://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.html
- https://github.com/s1kr10s/Sumavision_EMR3.0
- https://www.youtube.com/watch?v=Ufcj4D9eA5o
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10181
