CVE-2020-10181
Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
Description
CVE-2020-10181 is a critical cross-site request forgery (CSRF) vulnerability in the Sumavision Enhanced Multimedia Router (EMR) version 3.0.4.27. The flaw allows an attacker to create arbitrary user accounts with elevated administrator privileges on the device by tricking an authenticated administrator into visiting a malicious page. CISA has added CVE-2020-10181 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 20.6% (95.5th percentile), this vulnerability presents a significant exploitation probability for organizations using Sumavision EMR devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sumavision | enhanced multimedia router firmware | 3.0.4.27 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/s1kr10s/Sumavision_EMR3.0(Exploit, Third Party Advisory)
- https://www.youtube.com/watch?v=Ufcj4D9eA5o(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10181(US Government Resource)
Weakness Type
CWE-352: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery is a vulnerability class where a malicious website causes a user’s browser to perform unwanted actions on a trusted site where the user is currently authenticated. In the Sumavision EMR, the goform/formEMR30 endpoint lacks proper CSRF token validation, allowing an attacker to forge requests that create new administrator accounts without the legitimate administrator’s knowledge.
Learn more: CWE-352 — Cross-Site Request Forgery (CSRF)
Impact Analysis
CVE-2020-10181 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting maximum-severity risk. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication or user interaction from the victim (the CVSS metrics treat the forged request as not requiring direct user interaction for the vulnerability itself). Successful exploitation allows an attacker to create accounts with full administrator privileges, resulting in high impact to confidentiality, integrity, and availability of the affected Sumavision EMR device. The EPSS score of 20.6% (95.5th percentile) indicates a substantial likelihood of exploitation. Although not currently linked to ransomware campaigns, the ability to gain administrative control of network multimedia routing equipment presents serious risk for media infrastructure operators.
Exploit Maturity
Public exploit code is available for CVE-2020-10181 via Packet Storm Security and a proof-of-concept repository on GitHub. CISA has confirmed active exploitation by adding the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03. The EPSS score of 20.6% (95.5th percentile) indicates a notable probability of exploitation activity. The availability of detailed exploit code, including video demonstrations, significantly lowers the barrier for attackers targeting unpatched Sumavision EMR devices.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Contact Sumavision for the latest firmware release that addresses the CSRF vulnerability in the EMR 3.0.4.27.
- If vendor patches are not available, restrict access to the EMR administration interface to trusted internal networks only, preventing external exposure that could facilitate CSRF attacks.
- Implement anti-CSRF protections at the network level by deploying a web application firewall (WAF) that can detect and block cross-site request forgery attempts targeting the goform/formEMR30 endpoint.
- Audit all administrator accounts on the EMR device for unauthorized entries, removing any accounts that were not intentionally created by legitimate administrators.
- Enforce strict session management policies, including short session timeouts and requiring re-authentication for sensitive actions like user account creation.
Technical Details
CVE-2020-10181 targets the goform/formEMR30 endpoint in Sumavision Enhanced Multimedia Router firmware version 3.0.4.27. The endpoint processes POST requests for user management operations without validating CSRF tokens, meaning any authenticated administrator’s browser session can be exploited to submit forged requests. The attack payload uses a setString parameter in the format new_user<1>administrator<1>123456 to create a new user with administrator role and a specified password. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the attack is network-based with low complexity and no prerequisites, though in practice the attacker must lure an authenticated administrator to a malicious page for the CSRF to succeed.
Frequently Asked Questions
Is CVE-2020-10181 being actively exploited?
Yes. CVE-2020-10181 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code and proof-of-concept demonstrations are readily available, and the EPSS score of 20.6% (95.5th percentile) indicates a notable probability of exploitation.
What products are affected by CVE-2020-10181?
CVE-2020-10181 affects Sumavision Enhanced Multimedia Router (EMR) firmware version 3.0.4.27. The vulnerability is present in the goform/formEMR30 endpoint used for user management.
How do I fix CVE-2020-10181?
Apply firmware updates from Sumavision that address the CSRF vulnerability. If patches are unavailable, restrict access to the EMR administration interface to trusted internal networks and audit all administrator accounts for unauthorized entries.
How severe is CVE-2020-10181?
CVE-2020-10181 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 20.6% (95.5th percentile). The vulnerability allows attackers to create administrator accounts on the device, making it a high-priority remediation item.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.