CVE-2015-2848

Honeywell Tuxedo Touch < 5.1.13.0_va - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/857948

Scores

EPSS 0.0066
EPSS Percentile 47.1%

Details

CWE
CWE-352
Status published
Products (1)
honeywell/tuxedo_touch < 5.1.13.0_va
Published Jul 26, 2015
Tracked Since Feb 18, 2026