CVE-2026-7005 Details

A cross-origin request forgery vulnerability has been identified in WIT SynApps Runtime versions through 1.4.11. This vulnerability allows attackers to manipulate controller onboarding by supplying arbitrary target addresses. As a result, the victim's browser sends discovery requests to the specified hosts, probing internal network resources and initiating unauthorized enrollment flows with REDY instances. This exploitation crosses IT/OT segmentation boundaries through a legitimate application pathway.

Remove unrestricted target selection from the public frontend. Bind each authenticated user to a server-maintained inventory of approved controllers. Require explicit, authenticated controller enrollment with a cryptographic proof of device identity. Prevent silent discovery of unapproved private-network targets. Until a fix is available, operators should restrict access to REDY management functions from dedicated administration workstations and network segments.