CVE-2020-36283

HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to upload a configuration file to the device. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

• CWE-352

• https://exchange.xforce.ibmcloud.com/vulnerabilities/198443Third Party Advisory, VDB Entry
• https://www.hidglobal.com/sites/default/files/resource_files/hid-psa-2020-01-omnikey-csrf-security-advisory-paper.pdfMitigation, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/198443Third Party Advisory, VDB Entry
• https://www.hidglobal.com/sites/default/files/resource_files/hid-psa-2020-01-omnikey-csrf-security-advisory-paper.pdfMitigation, Vendor Advisory

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36278Leptonica before 1.80.0 allows a heap-based buffer over-read…7.5
• CVE-2020-36279Leptonica before 1.80.0 allows a heap-based buffer over-read…7.5
• CVE-2020-3628Improper access due to socket opened by the logging applicat…9.8
• CVE-2020-36280Leptonica before 1.80.0 allows a heap-based buffer over-read…7.5
• CVE-2020-36281Leptonica before 1.80.0 allows a heap-based buffer over-read…7.5
• CVE-2020-36282JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2…9.8
• CVE-2020-36284Union Pay up to 3.4.93.4.9, for android, contains a CWE-347:…7.5
• CVE-2020-36285Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-…7.5
• CVE-2020-36286The membersOf JQL search function in Jira Server and Data Ce…5.3
• CVE-2020-36287The dashboard gadgets preference resource of the Atlassian g…5.3
• CVE-2020-36288The issue navigation and search view in Jira Server and Data…6.1
• CVE-2020-36289Affected versions of Atlassian Jira Server and Data Center a…5.3