CVE-2020-21884

PoC —

CVSS 3.1

8.8 high

EPSS

1%p65

Published

Apr 9, 2021 (Apr 9, 2021)

Modified

Jul 9, 2026

Description

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.

Vendors: indionetworks
Products: unibox u50 firmware, unibox u500 firmware, unibox u1000 firmware, unibox u2500 firmware, unibox u5000 firmware
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.