CVE-2020-13259
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RAD SecFlow-1v是以色列RAD数据通信有限公司（RAD）的一款紧凑型的安全网关设备SecFlow-1是工业物联网回程的的理想之选，可实现快速、安全、经济地部署新的IoT站点。它允许通过无线或光纤网络（公共（如蜂窝）或专用网络实现安全连接，连接所有类型的工业设备，包括RTUs、智能电表聚合设备、IoT基站或集中器、闭路电视摄像机、销售点设备、Wi-Fi基站等。 RAD SecFlow-1v os-image SF_0290_2.3.01.26 版本存在跨站请求伪造漏洞，该漏洞源于WEB应用未充分
Public Exploits 1
ExploitDB · 1
EDB-48809 [webapps]
Possible ATT&CK Techniques 1 AI
T1566.001 · Spearphishing Attachment
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-13259
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
RAD SecFlow-1v os-image 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RAD SecFlow-1v是以色列RAD数据通信有限公司（RAD）的一款紧凑型的安全网关设备SecFlow-1是工业物联网回程的的理想之选，可实现快速、安全、经济地部署新的IoT站点。它允许通过无线或光纤网络（公共（如蜂窝）或专用网络实现安全连接，连接所有类型的工业设备，包括RTUs、智能电表聚合设备、IoT基站或集中器、闭路电视摄像机、销售点设备、Wi-Fi基站等。 RAD SecFlow-1v os-image SF_0290_2.3.01.26 版本存在跨站请求伪造漏洞，该漏洞源于WEB应用未充分
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2020-13259
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | PoC of Full Account Takeover on RAD SecFlow-1v | https://github.com/UrielYochpaz/CVE-2020-13259 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-13259
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2020-13259 (2)
-
https://cxsecurity.com/issue/WLB-2020090064 x_refsource_MISC
-
Same Patch Batch · n/a · 2020-09-16 · 49 CVEs total
| CVE-2020-7733 | 7.5 HIGH | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-10715 | Red Hat OpenShift web console 输入验证错误漏洞 | |
| CVE-2020-14519 | Wibu CodeMeter WebSockets API 访问控制错误漏洞 | |
| CVE-2020-20406 | Elementor Page Builder 跨站脚本漏洞 | |
| CVE-2020-24374 | Freebox HD 输入验证错误漏洞 | |
| CVE-2020-24373 | Freebox server 跨站请求伪造漏洞 | |
| CVE-2020-24376 | Freebox HD 输入验证错误漏洞 | |
| CVE-2020-24377 | Freebox OS Web interface 输入验证错误漏洞 | |
| CVE-2020-16233 | CodeMeter 安全漏洞 | |
| CVE-2020-10718 | Red Hat Wildfly 安全漏洞 | |
| CVE-2020-1694 | Red Hat Keycloak 安全漏洞 | |
| CVE-2020-14509 | wibu CodeMeter 安全漏洞 | |
| CVE-2020-10748 | Red Hat Keycloak 跨站脚本漏洞 | |
| CVE-2020-25040 | Singularity 安全漏洞 | |
| CVE-2020-14348 | Red Hat AMQ 代码问题漏洞 | |
| CVE-2020-25039 | Microsoft Research Singularity 安全漏洞 | |
| CVE-2020-13928 | Apache Atlas 跨站脚本漏洞 | |
| CVE-2020-25015 | Genexis Platinum 跨站请求伪造漏洞 | |
| CVE-2020-3990 | VMware Workstation 输入验证错误漏洞 | |
| CVE-2020-3989 | VMware Workstation 缓冲区错误漏洞 |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-13259
No comments yet