CVE-2026-57469
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A CWE-352 Cross-Site Request Forgery (CSRF) vulnerability was identified in the web-based configuration backend of KUNBUS PiCtory version 2.16.0. A remote unauthenticated attacker can perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.
Risk Assessment
The risk includes the possibility of remote execution of unauthorized operations in the context of an authenticated operator, potentially leading to data loss and system disruption.
Recommendation
It is recommended to update PiCtory to the latest version and implement CSRF protection mechanisms, such as anti-CSRF tokens.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.