CVE-2020-10181: Sumavision EMR router allows unauthenticated admin user creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote admin account creation, public exploits, and CISA KEV listing make this a critical risk requiring immediate action.

What it is

The goform/formEMR30 endpoint in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 permits creation of arbitrary users with administrator privileges via a crafted setString request. The flaw is classified as CSRF (CWE-352) and carries a CVSS 3.1 score of 9.8, meaning a remote, unauthenticated attacker can gain full administrative control of the device.

Impact

An attacker gains a persistent administrator account on the router, enabling full control over device configuration and traffic handling. This can lead to interception or redirection of network traffic and further compromise of connected systems.

Attack surface

The endpoint is reachable over the network (AV:N) with no authentication or user interaction required (PR:N, UI:N). The CSRF classification suggests the request may also be triggered through a victim's browser session, but the record does not detail the exact delivery mechanism.

Exploitation

CVE-2020-10181 is listed in CISA KEV (added 2021-11-03) and has public exploit references, indicating active exploitation. EPSS 30-day probability is 0.14666 (96.5th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor update per CISA KEV required action; if no patch exists, isolate or replace affected EMR 3.0.4.27 devices.
• Restrict management interface access to trusted networks and disable remote administration where not required.
• Enforce CSRF protections or token validation on goform/formEMR30 if the device supports configuration hardening.
• Monitor for unauthorized administrator account creation and audit existing accounts on EMR devices.
• Segment router management traffic from user and internet-facing networks.

Detection

• Alert on POST requests to goform/formEMR30 containing setString parameters that create users with administrator privileges.
• Audit router logs for new administrator accounts or unexpected configuration changes.
• Monitor for known exploit payloads referencing Sumavision EMR from public exploit repositories.
• Track outbound or inbound connections to EMR management interfaces from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.