CVE-2024-0555 is a medium severity CSRF flaw in Xantech WIC1200, scored CVSS 4.6. The record lists WIC1200 version 1.1 (firmware and hardware CPEs for Xantech). The record names no fixed version. Read the checks below to find out whether you run an affected build.
What's affected
The record lists WIC1200 version 1.1 (firmware and hardware CPEs for Xantech). The advisory is the INCIBE CERT notice on Full Compass Systems WIC1200 products.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L, with a base score of 4.6 (Medium). KEV status: not listed in the record.
Fixed version: The record names no fixed version. Ask the vendor and read the INCIBE notice for updates.
How to check if you're exposed
Open the device or product admin interface and read the firmware or software version on the system or about page. Compare it with the version in the record, and with the vendor notice. If you cannot tell, ask the vendor or integrator for the exact build.
What to do now
- Inventory the affected devices and where they sit on the network.
- Apply the vendor fix or firmware named in the advisory, and confirm the version afterwards.
- Limit access to the management interface to a trusted network and require strong credentials.
- Record the device in your asset inventory with the CVE so the fix is tracked.
Why it matters
CWE-352 describes this class. Cross-site request forgery means the application accepts a state changing request without proving that the logged in user meant to send it. Without an anti forgery token, any page the user visits can try to trigger actions in the session they already hold. Because the flaw needs a logged in user to be lured into acting, the practical risk depends on who uses the interface and from which browser.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-16.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0555 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Where do I get the fix?
From the vendor or integrator. The advisory linked in the sources is the place to start.
Sources
- Safeguard Gold entry for CVE-2024-0555
- NVD record data for CVE-2024-0555, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
