CVE-2024-0555: Xantech WIC1200 Firmware CSRF Vulnerability

CVE-2024-0555 Overview

CVE-2024-0555 is a Cross-Site Request Forgery (CSRF) vulnerability in the Xantech WIC1200 wireless intercom device running firmware version 1.1. The flaw stems from missing CSRF token validation in the web management interface. An attacker can craft a malicious page or link that, when visited by an authenticated user, triggers unwanted state-changing actions on the device. The Spanish National Cybersecurity Institute (INCIBE) coordinated the disclosure of this issue [CWE-352].

Critical Impact
Successful exploitation lets a remote attacker perform authenticated actions on the WIC1200 device on behalf of a logged-in user, impacting confidentiality, integrity, and availability of the device configuration.

Affected Products

Xantech WIC1200 hardware appliance
Xantech WIC1200 firmware version 1.1
Full Compass Systems WIC1200 distributions covered by the INCIBE advisory

Discovery Timeline

2024-01-16 - CVE-2024-0555 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0555

Vulnerability Analysis

The WIC1200 web management interface accepts authenticated state-changing requests without verifying that the request originated from the application itself. Because the application does not implement a CSRF token bound to the user session, the browser will replay the user's session cookies for any cross-origin request. An attacker who convinces an authenticated administrator to visit a crafted page can therefore submit forged requests that the device treats as legitimate. The vulnerability requires user interaction but no attacker-side authentication, since the victim supplies the session context.

Root Cause

The root cause is the lack of a proper anti-CSRF token implementation on privileged endpoints of the WIC1200 firmware version 1.1. State-changing HTTP requests rely solely on session cookies for authentication, which browsers attach automatically. There is no per-request unpredictable token, no Origin or Referer enforcement, and no use of the SameSite cookie attribute to constrain cross-site submissions.

Attack Vector

Exploitation follows the standard CSRF pattern for embedded web management interfaces. The attacker hosts a malicious HTML page containing an auto-submitting form or XMLHttpRequest targeting a WIC1200 administrative endpoint. When an administrator with an active WIC1200 session loads the page, the browser sends the forged request along with valid session cookies. The device executes the action, which may include configuration changes or account modifications. No verified public proof-of-concept exploit is available at this time.

See the INCIBE Security Notice for the coordinated advisory details.

Detection Methods for CVE-2024-0555

Indicators of Compromise

HTTP requests to the WIC1200 management interface with Referer or Origin headers pointing to unrelated third-party domains.
Unexpected configuration changes, new administrative accounts, or password resets on WIC1200 devices with no matching admin activity in logs.
Authenticated POST requests to the device arriving immediately after an administrator visited an external link or email.

Detection Strategies

Inspect web server access logs on the WIC1200 for state-changing requests with cross-origin Referer values or missing custom headers.
Correlate administrator browsing telemetry with WIC1200 configuration change events to identify request flows initiated by external content.
Alert on administrative session activity that occurs within seconds of the user opening webmail or unknown web content.

Monitoring Recommendations

Log all authenticated POST, PUT, and DELETE requests to the WIC1200 management interface and forward them to a central log store for review.
Monitor network egress from administrative workstations for connections to the WIC1200 immediately following visits to untrusted domains.
Track configuration baselines for WIC1200 devices and generate alerts on unauthorized deviations.

How to Mitigate CVE-2024-0555

Immediate Actions Required

Restrict access to the WIC1200 management interface to a dedicated management VLAN or trusted source IP addresses only.
Require administrators to log out of the WIC1200 web interface immediately after each session and avoid browsing other sites while authenticated.
Contact Xantech or the reseller referenced in the INCIBE advisory to confirm the availability of firmware updates addressing CVE-2024-0555.

Patch Information

No vendor patch URL is listed in the NVD entry for CVE-2024-0555 at the time of publication. Refer to the INCIBE Security Notice for the most current vendor guidance and any firmware release addressing the missing CSRF token implementation on WIC1200 firmware 1.1.

Workarounds

Isolate the WIC1200 on a management network that is unreachable from user workstations and general internet browsing hosts.
Use a dedicated browser or browser profile solely for WIC1200 administration to prevent cross-site request submission from other tabs.
Enforce browser policies that set SameSite=Lax or stricter behavior and block third-party content on administrative workstations.

bash

# Configuration example: restrict WIC1200 management interface access with iptables
# Replace 192.0.2.10 with the trusted management workstation IP
iptables -A INPUT -p tcp -s 192.0.2.10 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.0.2.10 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP