CVE-2021-20120

The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.56% chance of exploitation in the next 30 days, 44th percentile

Published

2021-10-21

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2021-45

References

• CVE Record
• NVD entry

Related

• CVE-2021-20114
• CVE-2021-20121
• CVE-2021-20107
• CVE-2021-20122
• CVE-2021-20096
• CVE-2021-20123