{"id":"CVE-2019-13529","state":"PUBLISHED","title":"An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmw","description":"An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.","publishedAt":"2019-10-09T15:26:53.000Z","updatedAt":"2026-07-13T16:27:49.134Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"icscert","products":["SMA Solar Technology AG Sunny WebBox"],"affected":[{"vendor":"SMA Solar Technology AG","product":"Sunny WebBox","versions":[{"version":"Firmware Version 1.6 and prior","status":"affected"}]}],"references":["https://www.us-cert.gov/ics/advisories/icsa-19-281-01","http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html","https://packetstorm.news/files/id/154789"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T19:45:27.952Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/13xxx/CVE-2019-13529.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-13529","state":"PUBLISHED","datePublished":"2019-10-09T15:26:53.000Z","dateUpdated":"2026-07-13T16:27:49.134Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2019-07-11T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation."}],"affected":[{"vendor":"SMA Solar Technology AG","product":"Sunny WebBox","versions":[{"version":"Firmware Version 1.6 and prior","status":"affected"}]}],"references":[{"url":"https://www.us-cert.gov/ics/advisories/icsa-19-281-01","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CROSS-SITE REQUEST FORGERY (CSRF) CWE-352","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2019-10-10T16:06:06.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2019-13529","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Sunny WebBox","version":{"version_data":[{"version_value":"Firmware Version 1.6 and prior"}]}}]},"vendor_name":"SMA Solar Technology AG"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CROSS-SITE REQUEST FORGERY (CSRF) CWE-352"}]}]},"references":{"reference_data":[{"name":"https://www.us-cert.gov/ics/advisories/icsa-19-281-01","refsource":"MISC","url":"https://www.us-cert.gov/ics/advisories/icsa-19-281-01"},{"name":"http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.us-cert.gov/ics/advisories/icsa-19-281-01","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/154789/SMA-Solar-Technology-AG-Sunny-WebBox-1.6-Cross-Site-Request-Forgery.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T23:57:39.443Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://packetstorm.news/files/id/154789","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-13T16:27:45.588330Z","id":"CVE-2019-13529","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-13T16:27:49.134Z"}}]}}}