CVE-2024-1889: Cross-Site Request Forgery vulnerability in SMA Cluster Controller

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-26 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device.

Affected products

SMA Clcon-10 Firmware: 01.05.01.r
SMA Clcon-S-10 Firmware: 01.05.01.r

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-sma-products
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-sma-products

Get alerted when CVE-2024-1889 or the next vulnerability affects your stack