CVE-2020-36906: P5 FNIP CSRF Vulnerability

CVE-2020-36906 Overview

CVE-2020-36906 is a Cross-Site Request Forgery (CSRF) vulnerability affecting P5 FNIP-8x16A and FNIP-4xSH devices running firmware version 1.0.20. This vulnerability allows attackers to perform administrative actions without user consent by crafting malicious web pages that trick authenticated users into submitting unauthorized requests. Successful exploitation enables attackers to add new admin users, change passwords, and modify system configurations through the device's user management interface.

Critical Impact

Attackers can gain full administrative control over affected P5 network devices by exploiting the lack of CSRF protections, potentially compromising entire network infrastructure management systems.

Affected Products

• P5 FNIP-8x16A firmware version 1.0.20
• P5 FNIP-4xSH firmware version 1.0.20

Discovery Timeline

• 2026-01-06 - CVE-2020-36906 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2020-36906

Vulnerability Analysis

This vulnerability stems from the complete absence of CSRF token validation in the user management functionality of P5 FNIP-8x16A and FNIP-4xSH devices. When an authenticated administrator visits a malicious website while logged into the device's web interface, the attacker-controlled page can silently submit requests to the device on behalf of the administrator. Since the device does not validate the origin of requests or require anti-CSRF tokens, these malicious requests are processed as legitimate administrative actions.

The impact of successful exploitation is significant for network infrastructure management. An attacker can create new administrative accounts, granting persistent backdoor access to the device. Password changes can lock out legitimate administrators, while configuration modifications could disrupt network operations or create additional attack vectors.

Root Cause

The root cause of CVE-2020-36906 is the failure to implement anti-CSRF protections in the web-based administration interface. The firmware lacks:

1. CSRF Token Validation - No unique tokens are generated or validated for state-changing requests
2. Origin/Referer Header Checks - The application does not verify that requests originate from trusted sources
3. SameSite Cookie Attributes - Session cookies are not configured with SameSite restrictions to prevent cross-origin request attachment

This design flaw allows any website to forge requests to the device's administrative endpoints as long as the victim has an active session.

Attack Vector

The attack is network-based and requires user interaction. An attacker must convince an authenticated administrator to visit a malicious webpage while logged into the P5 device's web interface. The attack sequence involves:

1. The attacker crafts a malicious HTML page containing hidden forms that target the P5 device's user management endpoints
2. The victim administrator, who has an active session with the device, is lured to visit the malicious page through phishing or other social engineering techniques
3. Upon page load, JavaScript automatically submits the hidden form, which creates a new admin user or modifies existing credentials
4. The victim's browser attaches the valid session cookie to the forged request, authenticating it to the device
5. The device processes the request, completing the unauthorized administrative action

The attack can be delivered through malicious advertisements, compromised websites, or targeted phishing emails containing links to the attacker-controlled page.

Detection Methods for CVE-2020-36906

Indicators of Compromise

• Unexpected administrative user accounts appearing on P5 FNIP-8x16A or FNIP-4xSH devices
• Legitimate administrator credentials no longer working, indicating password changes
• Unauthorized configuration modifications to device settings
• Web server logs showing administrative requests originating from unexpected referrer URLs

Detection Strategies

• Review P5 device audit logs for user account creation or modification events that do not correlate with authorized change windows
• Monitor network traffic for HTTP POST requests to device user management endpoints from external sources
• Implement web application firewall rules to detect requests to administrative endpoints lacking valid CSRF tokens
• Conduct periodic reviews of configured administrative accounts to identify unauthorized additions

Monitoring Recommendations

• Enable verbose logging on P5 devices to capture all administrative actions with timestamps and source information
• Configure alerts for any user account changes on network infrastructure devices
• Deploy network monitoring to detect unusual traffic patterns to device management interfaces
• Implement session monitoring to identify anomalous administrative session behavior

How to Mitigate CVE-2020-36906

Immediate Actions Required

• Restrict access to the P5 device web management interface to trusted IP addresses only using firewall rules
• Ensure administrators log out of P5 device sessions before browsing other websites
• Implement network segmentation to isolate management interfaces from general network traffic
• Review and audit all current administrative accounts for unauthorized additions
• Consider disabling web-based management and using alternative configuration methods if available

Patch Information

No vendor patch information is currently available in the CVE data. Organizations should contact P5 directly at P5's website for the latest firmware updates that address this vulnerability. Additional technical details and security advisories are available from VulnCheck CSRF Advisory and Zero Science ZSL-2020-5564.

Workarounds

• Deploy a reverse proxy with CSRF protection in front of the device's web interface
• Restrict management interface access to a dedicated, isolated management VLAN
• Use browser profiles or separate browsers for device administration to prevent session cross-contamination
• Implement additional authentication requirements such as VPN access before reaching management interfaces

# Example firewall configuration to restrict management interface access
# Allow management access only from trusted administrator subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP