Threats tagged 'ghsa-36q7-7q5p-cw6h'

Tasmota firmware versions through 16.0.0 contain a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protections. By crafting a malicious Referer header that includes the device hostname or IP as a substring after a controlled domain, attackers can trick administrators into executing arbitrary console commands and reconfiguring device settings if no WebPassword is set.