CVE-2020-10181: Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 14.7% chance of exploitation in the next 30 days.

goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.

Affected products

• Sumavision Enhanced Multimedia Router Firmware: version 3.0.4.27 only

Published 2020-03-11. Last modified 2026-06-17.