CVE-2020-36908

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Secure Computing	SnapGear Management Console SG560	3.1.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/182969Third Party Advisory
https://packetstorm.news/files/id/157937Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/48554Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/secure-computing-snapgear-management-console-sg-cross-site-request-forgery-via-admin-usersThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5567.phpExploit, Third Party Advisory

Timeline

Published: Jan 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-369098.8SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delet CVE-2020-36919.8Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Comp CVE-2020-369108.8Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. A CVE-2020-369119.8Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative CVE-2020-369129.8Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers CVE-2020-369135.3All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session ide CVE-2020-369147.5QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept u CVE-2020-369157.5Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote acc CVE-2020-369168.8TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable CVE-2020-369177.5iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept a CVE-2020-369184.3iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative a CVE-2020-369196.1WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject mali