CVE-2020-21884

Name: CVE-2020-21884
Creator: NVD / NIST
Published: 2021-04-09T13:15:13.02+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 1.17%

Last modified Jun 17, 2026

CVE-2020-21884 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.. EPSS estimates a 1.17% chance of exploitation in the next 30 days.

Description

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

1.17%

63.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-352

Affected Software

Vendor	Product	Versions
Indionetworks	Unibox U50 Firmware	2.4
Indionetworks	Unibox U500 Firmware	2.4
Indionetworks	Unibox U1000 Firmware	2.4
Indionetworks	Unibox U2500 Firmware	2.4
Indionetworks	Unibox U5000 Firmware	2.4

References

http://wifi-soft.comVendor Advisory
https://s3curityb3ast.github.io/KSA-Dev-008.txtExploit, Third Party Advisory
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg07139.html
http://wifi-soft.comVendor Advisory
https://s3curityb3ast.github.io/KSA-Dev-008.txtExploit, Third Party Advisory
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg07139.html

Timeline

Published: Apr 9, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-21884?

How severe is CVE-2020-21884?

CVE-2020-21884 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.17% probability of exploitation in the next 30 days.

How do I fix CVE-2020-21884?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-21884?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST