CVE-2026-7005
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate enrollment against REDY instances, crossing IT/OT segmentation boundaries.
Risk Assessment
An attacker can probe internal networks and cross IT/OT segmentation, potentially leading to unauthorized access to OT systems.
Recommendation
Update WIT SynApps Runtime to a patched version and restrict the ability to supply arbitrary target addresses during controller onboarding.
Other vulnerabilities in WIT SynApps Runtime
See all- CVE-2026-7004Medium
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints.
- CVE-2026-7003Medium
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability. Static OAuth clientId and clientSecret values are embedded in JavaScript delivered to the frontend, such as in parameters.js, allowing unauthenticated attackers to recover them.
Original NVD description (English source)
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS