CVE-2026-119755

{
  "etk_id": "ETK-2026-3980",
  "cve_id": "CVE-2026-119755",
  "display_id": "CVE-2026-119755",
  "ghsa_id": "GHSA-36q7-7q5p-cw6h",
  "euvd_id": "EUVD-2026-120124",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site request forgery in Tasmota web management",
  "summary": "Tasmota through 16.0.0 is affected by a cross-site request forgery issue in its web management access checks. An unauthenticated attacker may cause an administrator on the device network to submit management actions, including console commands or configuration changes, if the administrator visits a malicious page and the device has no WebPassword configured.",
  "mitigation": "Update to a Tasmota build that includes commit 1cb7ebc. Until an updated build can be deployed, configure a WebPassword and limit access to the device web interface to trusted networks.",
  "vendor": "arendst",
  "product": "Tasmota",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 16.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Tasmota",
      "purl": null
    }
  ],
  "cwes": [
    352
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.369026683333335,
  "t0_at": "2026-11-09T17:27:01.011000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T17:27:01.011000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T17:27:01.011000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119755"
    }
  }
}