CVE-2020-8168

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-8168
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8 Vendor Advisory
https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8%2C
https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 Vendor Advisory
https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83%2C
https://www.ui.com/download/airmax-m Release Notes
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ui:ag-hp-2g16:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-2g20:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-5g23:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ag-hp-5g27:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:airgrid_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ar:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ar-hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm2-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm2hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm5-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:bm5hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:is-m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:lbem5-23:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:litestation_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:locom9:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:m900:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-2g18:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-5g22:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nb-5g25:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m2-13:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m5-16:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbe-m5-19:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nbm9:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm2:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm3:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:nsm5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m2-400:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-300:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-300-iso:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-400:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-400-iso:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbe-m5-620:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm10:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm365:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:pbm5:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:picom2hp:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:power_ap_n:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:rm2-ti:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:rm5-ti:-:*:*:*:*:*:*:*
History

07 Nov 2023, 03:26

Type Values Removed Values Added
References
  • {'url': 'https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8,', 'name': 'https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8,', 'tags': ['Not Applicable'], 'refsource': 'MISC'}
  • {'url': 'https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83,', 'name': 'https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83,', 'tags': ['Not Applicable'], 'refsource': 'MISC'}
  • () https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83%2C -
  • () https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8%2C -
Information

Published : 2020-05-26 16:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-8168

Mitre link : CVE-2020-8168

CVE.ORG link : CVE-2020-8168

JSON object : View

Products Affected

ui

  • is-m5
  • power_ap_n
  • nbm3
  • pbe-m5-400
  • nbe-m5-16
  • airos
  • nbe-m2-13
  • nsm5
  • pbe-m5-620
  • m5
  • m365
  • locom9
  • pbe-m5-300-iso
  • rm2-ti
  • pbe-m5-300
  • airgrid_m2
  • bm2hp
  • ag-hp-5g27
  • locom2
  • nsm365
  • picom2hp
  • nbe-m5-19
  • m2
  • lbem5-23
  • pbe-m5-400-iso
  • rm5-ti
  • ag-hp-5g23
  • ar
  • pbm365
  • m900
  • ag-hp-2g16
  • airgrid_m
  • nb-5g22
  • nbm9
  • nsm3
  • airgrid_m5
  • pbe-m2-400
  • ar-hp
  • ag-hp-2g20
  • nbm365
  • litestation_m5
  • m3
  • bm5-ti
  • bm2-ti
  • nb-2g18
  • pbm10
  • locom5
  • bm5hp
  • nsm2
  • pbm5
  • nb-5g25
CWE
CWE-352

Cross-Site Request Forgery (CSRF)