Description
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.
Published: 2026-10-30
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Browser-mediated SSRF that allows probes of internal hosts
Action: Apply Patch
AI Analysis

Impact

Web-based onboarding in WIT SynApps Runtime until version 1.4.11 allows a controller to specify arbitrary URLs. When a user follows the onboarding flow, the victim’s browser automatically requests those URLs, exposing internal hosts at paths such as /easy/GUI/Skins/Default/SiteLogo. This browser‑mediated SSRF can be used to probe loopback, localhost, or non‑public networks and to trigger other onboarding processes against REDY systems, potentially bypassing IT/OT segmentation.

Affected Systems

WIT SynApps Runtime up to and including 1.4.11 is affected. Administrators should verify whether they run any version of the SynApps Runtime product from WIT and whether the controller onboarding feature is enabled.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. EPSS is not publicly available, and the vulnerability is not in the KEV catalog. Based on the description, it is inferred that the attacker must leverage a victim’s browser acting on a crafted onboarding URL; the primary vector is therefore likely user interaction or phishing. Based on the information provided, it is inferred that an attacker could send a link that triggers the onboarding flow, causing the browser to reach internal systems that may otherwise be unreachable from the Internet.

Generated by OpenCVE AI on October 30, 2026 at 21:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for WIT SynApps Runtime that resolves the browser‑mediated SSRF in the onboarding controller.
  • If an immediate patch cannot be applied, disable or restrict the controller onboarding feature to prevent untrusted URL inputs.
  • Restrict outbound web traffic from end‑user browsers to internal network ranges, or enforce a web proxy that blocks such requests from untrusted origins.
  • Monitor internal network traffic for unexpected requests originating from external user browsers during the onboarding process.

Generated by OpenCVE AI on October 30, 2026 at 21:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wit
Wit synapps Runtime
Vendors & Products Wit
Wit synapps Runtime

Fri, 30 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.
Title WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
Weaknesses CWE-346
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Wit Synapps Runtime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T19:52:12.878Z

Reserved: 2026-04-24T20:48:45.506Z

Link: CVE-2026-7005

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T19:19:13.937

Modified: 2026-10-30T20:17:19.433

Link: CVE-2026-7005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T22:48:50Z

Weaknesses