CVE-2024-1889 is a high severity (CVSS 8.8) cross-site request forgery flaw in the SMA Cluster Controller, version 01.05.01.R. An attacker can send a malicious link to an authenticated user and perform actions with that user's permissions. The record names no fixed version, so check the INCIBE notice and SMA for an update.
What's affected
The NVD record names SMA Cluster Controller firmware 01.05.01.R, covering the CLCON-10 and CLCON-S-10 models. The reference is a notice from INCIBE-CERT, Spain's national CSIRT, covering multiple vulnerabilities in SMA products.
The record does not state a fixed version, and the INCIBE page did not return readable text when this article was prepared. Treat the fix status as unconfirmed and check the notice and the vendor directly. The NVD severity is High at CVSS 8.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
How to check if you're exposed
This is a device firmware issue, so there is no package manager query. Check the firmware version in the device's web interface or service tool, and compare it with 01.05.01.R. Also list which models you run, since the record names the CLCON-10 and CLCON-S-10.
Then ask who can reach the device's web interface and which browsers the people logged in to it use. CSRF depends on a logged in user visiting a hostile page, so the exposure is about user behavior as much as the device itself.
What to do now
- Inventory every SMA Cluster Controller and note the firmware version.
- Read the INCIBE-CERT notice and contact SMA for a fixed firmware release.
- Install the vendor update as soon as it is confirmed.
- Until then, place the interface on a management network that is not reachable from general user networks or the internet.
- Tell operators not to browse other sites or open links from email while logged in to the device interface.
Why it matters
The weakness is CWE-352, cross-site request forgery. The device accepts state changing requests from a logged in browser without checking that the request really came from its own pages. A hostile page or link can therefore make the victim's browser send a request that the device treats as legitimate.
The attacker needs no account of their own. They need a user who is logged in and willing to follow a link, which is why the CVSS vector shows no privileges and required user interaction. The impact is high across confidentiality, integrity and availability because the forged action runs with the victim's permissions. Standard defenses are anti-forgery tokens, same-site cookie attributes and short sessions, all of which belong in the vendor's fix. The record's KEV flag is false and no source here reports exploitation in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
What makes CSRF different from other web flaws?
The attacker never logs in. They rely on a victim who is already logged in, and the victim's browser sends the forged request.
Is a fixed version confirmed?
Not in the record. Check the INCIBE notice and the vendor.
Sources
Last reviewed: 19 October 2026.
