CVE-2020-24847: Fruitywifi Project Fruitywifi

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.

Affected products

• Fruitywifi Project Fruitywifi: up to and including 2.4

Published 2020-10-23. Last modified 2026-06-17.