P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

published 2026-02-05 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2020-31048

cvss: 3.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interaction. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted page.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 9 mo ago (2026-02-06)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php referenced PoC, tagged "exploit" by a source, unverified
exploit-db.com https://www.exploit-db.com/exploits/48362 referenced PoC, tagged "exploit" by a source, unverified
packetstorm.news https://packetstorm.news/files/id/157318 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

P5 FNIP-8x16A

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

zeroscience.mk /en/vulnerabilities/ZSL-2020-5564.php
technical-description, exploit
exploit-db.com /exploits/48362
exploit
packetstorm.news /files/id/157318
exploit
exchange.xforce.ibmcloud.com /vulnerabilities/180253
third-party-advisory
p5.hu /
product
vulncheck.com /advisories/p-fnip-xa-fnip-xsh-cross-site-request-forgery-add-admin
third-party-advisory

Sources

CVE List CVE-2020-37118
NVD CVE-2020-37118

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary