Description
Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operations by having a user to view a specially crafted page.
Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| poe-boot-nino-poe8m2-firmware | 1.00a | 1.20a |
| pose-se10-8a7b1-firmware | — | — |
| signage-rebooter-rpc-m4hsi-firmware | — | — |
| time-boot-mini-rsc-mt4h-firmware | — | — |
| time-boot-mini-rsc-mt4hs-firmware | 1.00a | 1.10a |
| time-boot-rsc-mt8f-firmware | — | — |
| time-boot-rsc-mt8fp-firmware | — | — |
| time-boot-rsc-mt8fs-firmware | 1.00a | 1.00e |
| watch-boot-l-zero-rpc-m4l-firmware | — | — |
| watch-boot-l-zero-rpc-m4ls-firmware | 1.00a | 1.20a |
| watch-boot-light-rpc-m5c-firmware | — | — |
| watch-boot-light-rpc-m5cs-firmware | 1.00a | 1.00d |
| watch-boot-mini-rpc-m4h-firmware | — | — |
| watch-boot-nino-rpc-m2c-firmware | — | — |
| watch-boot-nino-rpc-m2cs-firmware | 1.00a | 1.00d |
References
Similar Threats
- Medium CVE-2022-28717
Patch Gap Protection
Running software with known vulnerabilities?
BotEraser can help reduce exposure by blocking IPs associated with exploit activity — even before a patch is available.
Start Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.