CVE-2019-13529

🗓️ 09 Oct 2019 15:26:53Reported by icscertType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

An attacker could send a malicious link to an authenticated operator, allowing remote attackers to perform actions with the user's permissions on Sunny WebBox Firmware

Reporter	Title	Published	Views	Family All 15
0day.today	SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery Vulnerability	10 Oct 201900:00	–	zdt
BDU FSTEC	The vulnerability of the microprogramming software in the remote control system for solar panels, SMA Solar Sunny WebBox, related to the manipulation of inter-site requests, allows a intruder to increase their privileges.	9 Dec 201900:00	–	bdu_fstec
Circl	CVE-2019-13529	21 Sep 202104:41	–	circl
Check Point Advisories	SMA Solar Technology Sunny WebBox Cross-Site Request Forgery (CVE-2019-13529)	21 Nov 202000:00	–	checkpoint_advisories
Cvelist	CVE-2019-13529	9 Oct 201915:26	–	cvelist
Exploit DB	SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery	10 Oct 201900:00	–	exploitdb
EUVD	EUVD-2019-4984	7 Oct 202500:30	–	euvd
exploitpack	SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery	10 Oct 201900:00	–	exploitpack
ICS	SMA Solar Technology AG Sunny WebBox	8 Oct 201900:00	–	ics
NVD	CVE-2019-13529	9 Oct 201916:15	–	nvd

NVD

Vulners

Node

sma sunny_webbox_firmwareRange≤1.6

AND

sma sunny_webboxMatch-

[
  {
    "product": "Sunny WebBox",
    "vendor": "SMA Solar Technology AG",
    "versions": [
      {
        "status": "affected",
        "version": "Firmware Version 1.6 and prior"
      }
    ]
  }
]

Source	Link
us-cert	www.us-cert.gov/ics/advisories/icsa-19-281-01
packetstormsecurity	www.packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html

Parameter	Position	Path	Description	CWE
RadioButtonDhcp	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
IpAddr	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
SubnetMask	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
Gateway	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
DnsIpAddr	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
Dns2IpAddr	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
StaticNatPortHttp	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
WebserverPort	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
WebservicePort	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352
RadioButtonModbus	request body	/wb_network_changed.htm	CSRF via hidden auto-submitting form changing network settings (URL /wb_network_changed.htm).	CWE-352

17 Jun 2026 02:16Current

8.3High risk

Vulners AI Score8.3

CVSS 26.8

CVSS 3.18.8

EPSS0.0223

CWE-352