CVE-2020-21884: Indionetworks Unibox u1000 Firmware

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.

Affected products

• Indionetworks Unibox u1000 Firmware: version 2.4 only
• Indionetworks Unibox u2500 Firmware: version 2.4 only
• Indionetworks Unibox u5000 Firmware: version 2.4 only
• Indionetworks Unibox u500 Firmware: version 2.4 only
• Indionetworks Unibox u50 Firmware: version 2.4 only

Published 2021-04-09. Last modified 2026-07-09.