PT-2024-15654 · Wic1200 · Wic1200

Hadess · Published 2024-01-16 · Updated 2024-01-23 · CVE-2024-0555

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WIC1200 version 1.1

Description A Cross-Site Request Forgery (CSRF) vulnerability has been found, allowing an authenticated user to lead another user into executing unwanted actions inside the application they are logged in. This is due to the lack of proper CSRF token implementation.

Recommendations For version 1.1, consider implementing a proper CSRF token to prevent unauthorized actions. As a temporary workaround, restrict access to sensitive features within the application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-0555

Affected Products

Wic1200

References · 7

• https://osv.dev/vulnerability/CVE-2024-0555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0555 · Security Note
• https://twitter.com/CVEnew/status/1747206945843352053 · Twitter Post
• https://t.me/cvenotify/67528 · Telegram Post
• https://t.me/cvenotify/68403 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200 · Note
• https://twitter.com/VulmonFeeds/status/1747249539755491350 · Twitter Post