CVE-2020-23593

Name of the Vulnerable Software and Affected Versions OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028

Description A vulnerability allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through "/mgm log cfg.asp". The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.

Recommendations For OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP V3.3.1-191028, as a temporary workaround, consider disabling access to the "/mgm log cfg.asp" endpoint until a patch is available. Restrict access to the "Syslog -- Configuration page" to minimize the risk of exploitation. Avoid using the 'Remote' mode or 'Both' mode on the "Syslog -- Configuration page" until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.