{"id":"CVE-2026-7005","kind":"vulnerability","aliases":["CVE-2026-7005"],"related":[],"title":"WIT SynApps Runtime: browser forgery probes internal hosts during controller onboarding","description":"WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.","summary":"WIT SynApps Runtime through 1.4.11 lets an attacker supply an arbitrary target address during controller onboarding, so a victim's browser sends discovery requests to that host. An attacker can use this to probe loopback, local and internal-only network hosts and start enrollment against REDY instances.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ot-networks","other","redy","wit-synapps"],"not_affected_if":["unknown"],"how_to_check":"- Check whether the WIT SynApps Runtime is installed and its version is `1.4.11` or earlier.","fix":null,"status":"open","published_at":"2026-10-30T19:19:13+00:00","first_seen_at":"2026-10-30T19:25:31+00:00","triaged_at":"2026-10-30T19:26:27+00:00","updated_at":"2026-10-30T19:26:27+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T19:26:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WIT SynApps Runtime: browser forgery probes internal hosts during controller onboarding","impact":"medium","summary":"WIT SynApps Runtime through 1.4.11 lets an attacker supply an arbitrary target address during controller onboarding, so a victim's browser sends discovery requests to that host. An attacker can use this to probe loopback, local and internal-only network hosts and start enrollment against REDY instances.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wit-synapps","redy","ot-networks"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"internal hosts probed and REDY enrollment started from victim browser","analyst_note":"Check the NVD entry and vendor advisory for a fixed version and whether onboarding requires authentication.","how_to_check":"- Check whether the WIT SynApps Runtime is installed and its version is `1.4.11` or earlier.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running WIT SynApps Runtime 1.4.11 or earlier, especially where the application reaches internal or OT networks and REDY controllers. The issue depends on a browser of a user of the application making the requests, so exposure is tied to who can reach the onboarding flow. unknown whether any particular deployment setting changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4257,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-7005':14A,17A '/easy/gui/skins/default/identity':122C '/easy/gui/skins/default/sitelogo':120C '1.4.11':30B,78C 'address':38B,98C,134C 'allow':91C 'applic':158C 'arbitrari':36B,96C 'attack':33B,54B,92C,113C,123C 'attacker-specifi':112C 'boundari':154C 'browser':4A,46B,82C,106C,129C 'browser-medi':81C 'caus':102C 'contain':79C 'control':10A,40B,100C 'cross':85C,151C 'cross-origin':84C 'cve':12A,15A 'discoveri':48B,109C 'enrol':70B,146C 'flow':147C 'forgeri':5A,88C 'host':8A,52B,67B,115C,142C 'hostnam':136C 'initi':144C 'instanc':73B,150C 'intern':7A,64B,139C 'internal-on':63B,138C 'issu':108C 'it/ot':152C 'let':31B 'leverag':125C 'local':61B,135C 'loopback':60B,133C 'mediat':83C 'network':20B,66B,141C 'onboard':11A,41B,101C 'origin':86C 'ot':19B 'ot-network':18B 'path':117C,159C 'probe':6A,59B,132C 'reachabl':130C 'redi':22B,72B,149C 'request':49B,87C,110C 'runtim':3A,28B,76C 'sanction':157C 'segment':153C 'send':47B 'specifi':114C 'start':69B 'suppli':34B,94C 'synapp':2A,25B,27B,75C 'target':37B,97C 'use':56B 'victim':44B,104C,127C 'vulner':89C 'wit':1A,24B,26B,74C 'wit-synapp':23B","nicknames":[],"mitigations":[],"who_affected":"Teams running WIT SynApps Runtime 1.4.11 or earlier, especially where the application reaches internal or OT networks and REDY controllers. The issue depends on a browser of a user of the application making the requests, so exposure is tied to who can reach the onboarding flow. unknown whether any particular deployment setting changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:19:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-7005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7005","severity":null,"published_at":"2026-10-30T19:19:13+00:00","modified_at":"2026-10-30T19:23:25+00:00","first_seen_at":"2026-10-30T19:25:31+00:00","fetched_at":"2026-10-30T19:25:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}