{"id":"CVE-2026-7005","title":"WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding","summary":"WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue dis…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-346"],"vendor":"WIT","product":"SynApps Runtime","affected":["synapps_runtime <= 1.4.11"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T19:51:51.430538Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T19:52:12.878Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-7005","references":[{"url":"https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIT","label":"Researcher Disclosure"},{"url":"https://www.vulncheck.com/advisories/wit-synapps-runtime-browser-mediated-ssrf-via-controller-onboarding","label":"VulnCheck Advisory: WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding"}],"tags":["cve.org","exploit-available"],"epss":0.00124,"epssPercentile":0.02138,"ingestedAt":"2026-11-05T16:24:31.423Z","slug":"CVE-2026-7005","body":"## Overview\n\nWIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.\n\n## Affected\n\n- `synapps_runtime <= 1.4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}