CVE-2021-20120: CSRF
The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20120?
CVE-2021-20120 is a vulnerability in the administration web interface of the Arris Surfboard SB8200 that allows for cross-site request forgery attacks.
How does CVE-2021-20120 affect the Arris Surfboard SB8200?
CVE-2021-20120 allows attackers to make configuration changes on the Arris Surfboard SB8200 without user consent, such as changing the administrative password.
What is the severity of CVE-2021-20120?
The severity of CVE-2021-20120 is rated as high with a CVSS score of 8.8.
Is the Commscope Arris Surfboard SB8200 vulnerable to CVE-2021-20120?
Yes, the Arris Surfboard SB8200 with firmware version ab01.02.053.01_112320_193.0a.nsh is vulnerable to CVE-2021-20120.
How can I fix CVE-2021-20120 on my Arris Surfboard SB8200?
To fix CVE-2021-20120, it is recommended to update the firmware of the Arris Surfboard SB8200 to a version that includes the necessary protections against cross-site request forgery attacks.