CVE-2020-37144: XSRF in Exagate SYSGuard 6001

The primary impact of this XSRF vulnerability is the unauthorized creation of administrative accounts. An attacker could craft a malicious HTML form, hosted on a different domain, and entice a legitimate user of Exagate SYSGuard 6001 to submit it. Upon submission, the attacker gains the ability to create a new user account with administrative privileges, effectively compromising the system. This could lead to complete control over the SYSGuard instance, including data access, configuration changes, and potentially lateral movement within the network if SYSGuard has access to other resources. The blast radius extends to any data managed by the SYSGuard system, and the attacker could leverage the administrative account to install malware or further compromise the environment.

1. Reserved2026-02-03
2. Published2026-02-05
3. Modified2026-04-07
4. EPSS updated2026-03-23

The recommended mitigation for CVE-2020-37144 is to upgrade to a patched version of Exagate SYSGuard 6001 when available. In the absence of a patch, implementing a Web Application Firewall (WAF) with XSRF protection rules is crucial. These rules should validate the origin of requests to /kulyon.php and reject those originating from untrusted domains. Additionally, consider implementing stricter input validation and output encoding on the /kulyon.php endpoint to prevent malicious data from being processed. After implementing WAF rules, verify their effectiveness by attempting to submit a crafted XSRF request and confirming that it is blocked.