What’s Vulnerable › Vulnerabilities

CVE-2024-5676: Paradox IP150 Internet Module Cross-Site Request Forgery

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-19 · updated 2026-06-17
• Weakness: CWE-352

Description

The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system.

Affected products

• Paradox Security Systems (Bahamas) Ltd. IP150 Internet Module: 1.40.00

References

• http://seclists.org/fulldisclosure/2024/Jun/8
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery
• https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563
• http://seclists.org/fulldisclosure/2024/Jun/8
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery
• https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563

Get alerted when CVE-2024-5676 or the next vulnerability affects your stack