CVE-2024-0555 Cross-Site Request Forgery (CSRF) vulnerability on WIC1200
An attacker can trick authenticated users into performing unwanted actions on the WIC1200 device due to missing CSRF tokens.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-0555?
CVE-2024-0555 is a medium-severity vulnerability in Full Compass Systems WIC1200, published on 16 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could lead another user into executing unwanted actions inside the application they are logged in. This vulnerability is possible due to the lack of propper CSRF token implementation.
Weakness: CWE-352
Which versions are affected by CVE-2024-0555?
It affects 1 product.
Products include Xantech Wic1200 Firmware.
How do I fix CVE-2024-0555?
No fix has been published for CVE-2024-0555 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0555 being exploited?
There is no known exploitation of CVE-2024-0555 in the wild and no public exploit code.
Other vulnerabilities in Full Compass Systems WIC1200
Sources
Also known as GHSA-vvp5-2ffm-gmvh.