Description
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.
Published: 2026-08-14
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Cross‑Site Request Forgery vulnerability (CWE‑352) exists in the web‑based configuration backend of KUNBUS PiCtory version 2.16.0. An attacker who does not have valid credentials can cause a victim’s browser to submit crafted requests that execute state‑changing operations on behalf of an authenticated operator. The attacker could delete project and configuration files or reset the control runtime, compromising data integrity and system availability.

Affected Systems

KUNBUS PiCtory, version 2.16.0

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a victim to be logged in and to allow the attacker’s browser to submit requests, typically through a malicious link or embedded resource. The attack vector is inferred to be a browser‑based CSRF scenario, with no prerequisite that the attacker gain network access to the device.

Generated by OpenCVE AI on August 14, 2026 at 16:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a protected version of KUNBUS PiCtory.
  • Configure the device to enforce CSRF protection such as SameSite attributes on cookies and anti‑CSRF tokens for all state‑changing endpoints.
  • Block or limit requests from third‑party origins at the network or application firewall level to prevent malicious request forging.

Generated by OpenCVE AI on August 14, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Kunbus
Kunbus pictory
Vendors & Products Kunbus
Kunbus pictory

Fri, 14 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.
Title Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
Weaknesses CWE-352
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L'}

Subscriptions

Kunbus Pictory
cve-icon MITRE

Status: PUBLISHED

Assigner: Nozomi

Published:

Updated: 2026-08-14T19:43:32.897Z

Reserved: 2026-06-24T13:49:50.681Z

Link: CVE-2026-57469

cve-icon Vulnrichment

Updated: 2026-08-14T19:43:28.306Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-14T16:16:58.043

Modified: 2026-08-28T19:46:29.323

Link: CVE-2026-57469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T11:02:01Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)