CVE-2018-6907

HIGH

RainMachine Mini-8 and Touch HD 12 - Cross-Site Request Forgery via REST API

Title source: llm

Description

A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to control the RainMachine device via the REST API.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

http://www.irongeek.com/i.php?page=videos/bsidesrdu2018/bsidesrdu-2018-07-when-it-rains-it-pours-sam-granger

Scores

CVSS v3 8.8

EPSS 0.0049

EPSS Percentile 38.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

rainmachine/rainmachine_web_application

Published Nov 01, 2018

Tracked Since Feb 18, 2026