Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | Tuxedo Touch | <= 5.1.13.0_va |
Related Weaknesses (CWE)
References
- http://www.kb.cert.org/vuls/id/857948Third Party AdvisoryUS Government Resource
- http://www.kb.cert.org/vuls/id/857948Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2015-2848?
CVE-2015-2848 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-a...
How severe is CVE-2015-2848?
CVE-2015-2848 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-2848?
Check the references section above for vendor advisories and patch information. Affected products include: Honeywell Tuxedo Touch.