Nozomi Networks Labs identified a CWE-352 Cross-Site Request Forgery vulnerability in KUNBUS PiCtory version 2.16.0. The vulnerability allows remote unauthenticated attackers to perform state-changing operations in the context of an authenticated user by tricking the victim's browser into submitting crafted requests. Affected operations include deletion of project and configuration files and resetting the control runtime. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

An attacker can cause an authenticated operator's browser to execute unwanted state-changing actions without their consent, potentially leading to deletion of critical project and configuration files or resetting the control runtime. This can disrupt normal operation and cause loss of configuration data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about unsolicited links or web content that could trigger CSRF attacks while authenticated to the PiCtory backend.