⚠️ CISA Known Exploited Vulnerability
Active ThreatThis vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.
CVE-2020-10181
Critical CISA KEVVulnerability Description
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Affected Software
1 configuration(s) from 1 vendor(s)
cpe:2.3:o:sumavision:enhanced_multimedia_router_firmware:3.0.4.27:*:*:*:*:*:*:*
References & Resources
-
http://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.htmlcve@mitre.org Exploit Third Party Advisory VDB Entry
-
https://github.com/s1kr10s/Sumavision_EMR3.0cve@mitre.org Exploit Third Party Advisory
-
https://www.youtube.com/watch?v=Ufcj4D9eA5ocve@mitre.org Exploit Third Party Advisory
-
http://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.htmlaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory VDB Entry
-
https://github.com/s1kr10s/Sumavision_EMR3.0af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://www.youtube.com/watch?v=Ufcj4D9eA5oaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10181134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
Severity Details
CISA KEV Status
Listed in CISA's Known Exploited Vulnerabilities catalog
Key Information
- Published Date
- March 11, 2020
