P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

The CSRF vulnerability in P5 FNIP-8x16A FNIP-4xSH allows an attacker to leverage the authenticated session of a legitimate user to perform actions as if they were the user. This means an attacker could craft malicious web pages that, when visited by an authenticated administrator, would silently execute commands such as adding new administrator accounts, modifying existing user passwords, or altering system configurations. The attacker does not need to know the administrator's credentials, only that the user is logged in. Successful exploitation could grant the attacker complete control over the affected device, enabling them to monitor network traffic, modify device behavior, or even exfiltrate sensitive data. While the CVSS score is LOW, the potential for unauthorized administrative access makes this a serious concern.

Organizations utilizing P5 FNIP-8x16A FNIP-4xSH devices running version 1.0.20 are at risk. This includes deployments where administrative access is web-based and user authentication practices are not sufficiently robust to prevent XSRF attacks. Environments with shared hosting or where user accounts have broad administrative privileges are particularly vulnerable.

1. 2026-02-05Disclosure

   disclosure

1. Reserviert2026-02-03
2. Veröffentlicht2026-02-05
3. Geändert2026-04-07
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2020-37118 is to upgrade to a patched version of P5 FNIP-8x16A FNIP-4xSH. If upgrading is not immediately feasible, implement a Web Application Firewall (WAF) to filter requests and validate user input. Configure the WAF to block requests that lack proper CSRF tokens or originate from untrusted sources. Additionally, consider implementing stricter authentication policies, such as multi-factor authentication (MFA), to further reduce the risk of unauthorized access. Review and restrict administrative privileges to the minimum necessary level. After upgrade, confirm by attempting to perform administrative actions via a web browser and verifying that the actions are properly authenticated and require explicit user confirmation.