CVE-2020-15043

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/Saket-taneja/4dda4b2df5aa0973a7160bb6bf8875e0Exploit, Third Party Advisory
https://github.com/Saket-taneja/IballCSRFExploitThird Party Advisory
https://gist.github.com/Saket-taneja/4dda4b2df5aa0973a7160bb6bf8875e0Exploit, Third Party Advisory
https://github.com/Saket-taneja/IballCSRFExploitThird Party Advisory

Timeline

Published: Jun 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150468.8The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/confi CVE-2020-150475.9MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors, which allows man-in-the-middle attackers to spoof SMTP servers.CVE-2020-150498.8An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning att CVE-2020-15055.5An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who CVE-2020-150507.5An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server CVE-2020-150516.1An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MY CVE-2020-150527.5An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields.CVE-2020-150536.1An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Even CVE-2020-150548.8TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the CVE-2020-150558.8TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web CVE-2020-150564.3TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks CVE-2020-150576.5TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-service the device vi