Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| Enhanced Multimedia Router (EMR) | Versions not published yet (product named by CISA KEV) | |
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free