CVE-2020-23592

CVE-2020-23592 describes a critical Cross-Site Request Forgery (CSRF) vulnerability in the OPTILINK OP-XT71000N ONU (Hardware V2.2, Firmware OP_V3.3.1-191028). An unauthenticated, remote attacker can exploit this flaw by tricking a user into visiting a malicious page, triggering a factory reset via '/mgm_dev_reset.asp'. This reset allows for subsequent privilege escalation by logging in with default credentials. The vulnerability carries a high CVSSv3.1 score of 8.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While user interaction is required, the consequences of a successful exploit are significant. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a low level of public awareness or interest at this time.