Vulnerability record · CVE-2020-16208 · published 1 September 2020

CVE-2020-16208: Redlion n-tron 702-w firmware cross-site request forgery vulnerability

Redlion · N Tron 702 W Firmware

The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authenticated user to click on a crafted link on the N-Tron 702-W / 702M12-W (all versions).

8.8 CVSS 3.1 High EPSS 1.2% · top 32.1% CWE-352 · Cross-site request forgery

8.8CVSS 3.1 base score, v2 9.3

1.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

N Tron 702 W Firmware Redlion

N Tron 702m12 W Firmware Redlion

References

Link	Tags
http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html	Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/6	Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01	Third Party AdvisoryUS Government Resource
http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html	Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/6	Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01	Third Party AdvisoryUS Government Resource

Track CVE-2020-16208 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-16204Redlion n-tron 702-w firmware vulnerabilityThe affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on t…EPSS 5.5%1 Sep 2020 9.0CVE-2020-16206Redlion n-tron 702-w firmware cross-site scripting vulnerabilityThe affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to s…EPSS 3.2%1 Sep 2020 9.0CVE-2020-16210Redlion n-tron 702-w firmware cross-site scripting vulnerabilityThe affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform acti…EPSS 3.2%1 Sep 2020 8.8CVE-2017-16544Busybox code injection vulnerabilityIn the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames i…EPSS 6.2%20 Nov 2017 9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed26 Nov 2025 8.1CVE-2008-4128Cisco IOS HTTP Administration CSRF allows arbitrary command executionThe HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router is vulnerable to multiple cross-site request forgery flaws.…KEVEPSS 34%analysed18 Sep 2008 8.8CVE-2023-2533PaperCut NG/MF CSRF allows admin security setting changes and code executionPaperCut NG and MF contain a cross-site request forgery flaw that, under specific conditions, lets an attacker change security settings or execute ar…KEVEPSS 29%analysed20 Jun 2023 8.0CVE-2014-100005D-Link DIR-600 router CSRF enables admin account creation and remote managementThe D-Link DIR-600 (rev. Bx) with firmware before 2.17b02 is affected by multiple cross-site request forgery flaws in hedwig.cgi, pigwidgeon.cgi and …KEVEPSS 43%analysed13 Jan 2015

Source: NIST National Vulnerability Database (record CVE-2020-16208), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.