CVE-2020-36908: secure computing snapgear management console sg560 Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2020-36908 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in secure computing snapgear management console sg560. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 06-01-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.