Cross site request forgery (csrf)

2022-01-1014:10:00

PRIOn knowledge base

www.prio-n.com

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests.

CPENameOperatorVersion
ultimaker_3_firmwarele5.2.16
ultimaker_s3_firmwarele6.3
ultimaker_s5_firmwarele6.3

Name	Operator	Version
ultimaker_3_firmware	le	5.2.16
ultimaker_s3_firmware	le	6.3
ultimaker_s5_firmware	le	6.3

References

kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf

ultimaker.com/3d-printers/ultimaker-3

ultimaker.com/3d-printers/ultimaker-s3

ultimaker.com/3d-printers/ultimaker-s5