CVE-2024-5676

Paradox IP150 Internet Module Cross-Site Request Forgery

State: Published
Severity: 6.8 Medium
Published: Jun 19, 2024
Updated: Feb 13, 2025
Reserved: Jun 6, 2024

Description

The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H	sba-research

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
IP150 Internet ModuleParadox Security Systems (Bahamas) Ltd.	1.40.00Affected

References

https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgerythird-party-advisory
https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563product
http://seclists.org/fulldisclosure/2024/Jun/8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.