CVE-2020-10181

Timeline

Detection, updates, and resolution for this record.

1. Mar 11, 2020 · Catalog

   Detected

   goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user administrator 123456 request.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user administrator 123456 request.

Affected

• cpe sumavision/enhanced multimedia router firmware3.0.4.27
• vendor Sumavision Enhanced Multimedia Router (EMR)version unspecified

Sources

• CISA KEVCVE-2020-10181

  Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.

  cisa.gov
• CVE.orgCVE-2020-10181

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2020-10181

  30-day exploitation probability 14.7%

  first.org
• NIST NVDCVE-2020-10181

  goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user administrator 123456 request.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/156746/Enhanced-Multimedia-Router-3.0.4.27-Cross-Site-Request-Forgery.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Exploit · github.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Exploit · youtube.com