CVE-2020-37118: P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-05 · updated 2026-06-17
Weakness: CWE-352

Description

P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interaction. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted page.

Affected products

P5 FNIP-8x16A: 1.0.20

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/180253
https://packetstorm.news/files/id/157318
https://www.exploit-db.com/exploits/48362
https://www.p5.hu/
https://www.vulncheck.com/advisories/p-fnip-xa-fnip-xsh-cross-site-request-forgery-add-admin
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php

Get alerted when CVE-2020-37118 or the next vulnerability affects your stack