CVE-2024-0522 is a medium severity (4.3) cross site request forgery in RomPager. It affects Allegro RomPager 4.01. The record says upgrading to version 4.30 addresses the issue. Treat the product as exposed until you confirm the version and restrict who can reach it.
What's affected
- Product and location: Allegro RomPager 4.01, in the usertable.htm delete action of the HTTP POST request handler.
- The record says upgrading to version 4.30 addresses the issue. It also carries a vendor note that this is a very old issue that was fixed 20 years ago without public disclosure.
- Fixed version: Upgrading to version 4.30 addresses the issue.
- Severity: NVD scores it 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
- Published: 2024-01-14.
How to check if you're exposed
- Identify devices that embed RomPager. The server banner in HTTP responses from the device web interface often names it, so check yours with your usual HTTP client.
- Compare the version with 4.01 and 4.30 from the record.
- Ask the device vendor which RomPager version your firmware contains.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm whether you run the product and which version, using the checks above.
- Apply the upgrade the record describes.
- Log out of device admin pages when you finish.
- Do not browse other sites in a session that is signed in to a device admin page.
- Upgrade the component as the record recommends.
- Run the free dependency scan at gold.safeguard.sh/scan on projects of yours that bundle similar components, and look the CVE up in the Gold directory.
Why it matters
The weakness is CWE-352, cross site request forgery. The device accepts a state changing request, here a user delete action, without confirming that the request was intended by the logged in user. A malicious page can cause a browser that is logged in to the device to send it.
The score is low at 4.3 because the attacker needs a victim to be logged in and to visit a hostile page, and because the impact is limited to integrity. Still, embedded web servers like this one often sit inside routers and gateways, so a forged request can change who may log in.
The record lists CWE-352 for this CVE and carries no CISA Known Exploited Vulnerabilities flag. The scores in this post come from NVD and may be revised.
Quick check
Is this still an issue on current firmware?
The record says upgrading to 4.30 addresses it, and a vendor note says it was fixed long ago. Confirm which RomPager version your device firmware embeds with the device vendor.
Sources
I did not fetch the pages below, so every statement here comes from the NVD record. The VulDB entry and researcher write ups were not independently confirmed.
Last reviewed: 19 October 2026.
