CSRF in Ui Ag-Hp-2g16
CVE-2020-8168
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (51.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
Weakness classification (CWE)
References
- community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb…
- community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83,
- www.ui.com/download/airmax-m (Release Notes)
- community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb… (Vendor Advisory)
- community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-8168?
- CVE-2020-8168 is a high-severity vulnerability in Ui Ag-Hp-2g16, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2020-05-26.
- How severe is CVE-2020-8168?
- High severity. CVSS v3 base score is 8.8 out of 10.