Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Computrols CBAS can be tricked into unwanted actions

CVE-2019-10847 · published 7 years ago
Summary

The Computrols Building Automation Software (version 18.0.0) can be made to perform actions on behalf of an attacker without the user’s knowledge. This could let someone change building control settings or view information they shouldn’t. Apply the vendor’s security update or restrict cross‑site requests to trusted sites to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
computrols computrols_building_automation_software <= 19.0.0
cpe:2.3:a:computrols:computrols_building_automation_software:*:*:*:*:*:*:*:*
Original advisory text
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published24 May 2019
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-10847 · NVD
Track software like this
Free during beta