Threats tagged 'ghsa-xmrj-8287-w33q'

boneIO Black suffers from a Cross-Site Request Forgery (CSRF) vulnerability affecting all state-changing API endpoints due to the absence of CSRF tokens and lack of Origin or Referer header validation. An attacker on the same internal network can exploit this by luring a user to a malicious webpage, causing unauthorized actions such as rebooting the controller or toggling relay circuits. This vulnerability leads to loss of integrity and availability of the device. The issue is resolved in version 1.6.0.