CVE-2020-21884

HighCVSS 8.8

Published: 09/04/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.14%

63th percentile - higher than 63% of all known CVEs

Summary

Unibox SMB 2.4, UniBox Enterprise Series 2.4, and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in several endpoints, including /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, and /go?rid=202. A specially crafted HTTP request may allow an attacker to reconfigure the device without administrator consent.

Risk Assessment

The risk is that an attacker can exploit CSRF to change the network device configuration, potentially leading to network integrity compromise, data leakage, or service disruption.

Recommendation

It is recommended to immediately update the software to the latest version that fixes this vulnerability and implement CSRF protection mechanisms such as anti-CSRF tokens in web applications.

Other vulnerabilities in Unibox

CVE-2020-21883High
UniBox U-50 2.4, UniBox Enterprise Series 2.4, and UniBox Campus Series 2.4 contain an OS command injection vulnerability in the /tools/ping script. This flaw allows an attacker to gain complete control over the device.

Original NVD description (English source)

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.