Welotec: Clickjacking Vulnerability in WebUI
view advisory published 2024-04-23
Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-3911US | — | — | ||
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.
| ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Mitigation
This vulnerability can be mitigated with the use of an additional Reverse Proxy and / or Web Application Firewall protecting the WebUI.
- Fixed
Update the software to version 3.1.4 or later and configure the Content Security Policy (CSP).
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan