VDE-2024-023 — Welotec: Clickjacking Vulnerability in WebUI

Summary

Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.

Details

Impact
Please see the CVE description.

Mitigation
This vulnerability can be mitigated with the use of an additional Reverse Proxy and / or Web Application Firewall protecting the WebUI.

Remediation
Update the software to version 3.1.4 or later and configure the Content Security Policy (CSP).

Vulnerabilities 1

Medium 6.5

CVE-2024-3911

Welotec: Clickjacking Vulnerability in WebUI

An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.

Welotec VPN Security Suite SMART EMS

Apr 23, 2024

Revision history

2024-04-23 #1
Initial revision.

References

VDE-2024-023: Welotec: Clickjacking Vulnerability in WebUI - HTML
https://certvde.com/en/advisories/VDE-2024-023/
Vendor PSIRT
https://welotec.com
CERT@VDE Security Advisories for Welotec GmbH
https://certvde.com/en/advisories/vendor/welotec/