CSRF in Xzeres 442sr

CVE-2015-3950

Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.006 (46.8th percentile) — read the EPSS interpretation.

Affected products

Xzeres 442sr
Xzeres 442sr_os
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
ics-cert@hq.dhs.gov (vdb-entry, x_refsource_BID)