Vulnerability Details : CVE-2020-8168

We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Published 2020-05-26 16:15:13
Updated 2020-05-28 20:32:59
Source HackerOne
View at NVD,   CVE.org
Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2020-8168

  • UI » Airos
    Versions up to, including, (<=) 6.2.0
    cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*
    Matching versions
    When used together with: UI » Ag-hp-2g16 » Version: N/A
    When used together with: UI » Ag-hp-2g20 » Version: N/A
    When used together with: UI » Ag-hp-5g23 » Version: N/A
    When used together with: UI » Ag-hp-5g27 » Version: N/A
    When used together with: UI » Airgrid M » Version: N/A
    When used together with: UI » Airgrid M2 » Version: N/A
    When used together with: UI » Airgrid M5 » Version: N/A
    When used together with: UI » AR » Version: N/A
    When used together with: UI » Ar-hp » Version: N/A
    When used together with: UI » Bm2-ti » Version: N/A
    When used together with: UI » Bm2hp » Version: N/A
    When used together with: UI » Bm5-ti » Version: N/A
    When used together with: UI » Bm5hp » Version: N/A
    When used together with: UI » Is-m5 » Version: N/A
    When used together with: UI » Lbem5-23 » Version: N/A
    When used together with: UI » Litestation M5 » Version: N/A
    When used together with: UI » Locom2 » Version: N/A
    When used together with: UI » Locom5 » Version: N/A
    When used together with: UI » Locom9 » Version: N/A
    When used together with: UI » M2 » Version: N/A
    When used together with: UI » M3 » Version: N/A
    When used together with: UI » M365 » Version: N/A
    When used together with: UI » M5 » Version: N/A
    When used together with: UI » M900 » Version: N/A
    When used together with: UI » Nb-2g18 » Version: N/A
    When used together with: UI » Nb-5g22 » Version: N/A
    When used together with: UI » Nb-5g25 » Version: N/A
    When used together with: UI » Nbe-m2-13 » Version: N/A
    When used together with: UI » Nbe-m5-16 » Version: N/A
    When used together with: UI » Nbe-m5-19 » Version: N/A
    When used together with: UI » Nbm3 » Version: N/A
    When used together with: UI » Nbm365 » Version: N/A
    When used together with: UI » Nbm9 » Version: N/A
    When used together with: UI » Nsm2 » Version: N/A
    When used together with: UI » Nsm3 » Version: N/A
    When used together with: UI » Nsm365 » Version: N/A
    When used together with: UI » Nsm5 » Version: N/A
    When used together with: UI » Pbe-m2-400 » Version: N/A
    When used together with: UI » Pbe-m5-300 » Version: N/A
    When used together with: UI » Pbe-m5-300-iso » Version: N/A
    When used together with: UI » Pbe-m5-400 » Version: N/A
    When used together with: UI » Pbe-m5-400-iso » Version: N/A
    When used together with: UI » Pbe-m5-620 » Version: N/A
    When used together with: UI » Pbm10 » Version: N/A
    When used together with: UI » Pbm365 » Version: N/A
    When used together with: UI » Pbm5 » Version: N/A
    When used together with: UI » Picom2hp » Version: N/A
    When used together with: UI » Power Ap N » Version: N/A
    When used together with: UI » Rm2-ti » Version: N/A
    When used together with: UI » Rm5-ti » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-8168

EPSS FAQ
0.15%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-8168

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
 NIST

CWE ids for CVE-2020-8168

  • The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
    Assigned by:
    • nvd@nist.gov (Primary)
    • support@hackerone.com (Secondary)

References for CVE-2020-8168

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close