WIT SynApps Runtime CVE-2026-7005

Requires an operator/victim to be actively performing the controller onboarding/discovery workflow in a browser and to accept or be fed an attacker-specified target address (UI:P - passive user interaction), after which the victim's browser issues discovery requests to attacker-chosen hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. No authentication on the SynApps side is indicated (PR:N). Realistic exploitation is limited by: (1) the need for a victim to be engaged in the onboarding flow, and (2) the attacker's gain being bounded by the victim browser's own network reachability to loopback/local/internal OT hosts - so impact depends on the victim being positioned to reach otherwise-segmented REDY instances. The vulnerable SynApps system itself is not directly compromised; impact lands on the probed/enrolled subsequent systems.

This is a medium-severity (CVSS 4.0 base 5.3) origin-validation flaw (CWE-346) whose real-world priority is moderate, not critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity, unauthenticated issue, but exploitation is passive-user-interaction dependent (UI:P) and the vulnerable system itself takes no direct impact (VC:N/VI:N/VA:N) - all impact is on subsequent systems (SC:L/SI:L), consistent with a browser-mediated SSRF/CSRF that uses the victim's browser as a proxy rather than compromising SynApps directly. Exploitation status: no public exploit identified as working - a public PoC reference exists (kmkz/Exploits, covering CVE-2026-7003/7004/7005), but the input marks it as reference only, not verified as working exploit code, so POC availability must not be conflated with active exploitation. There is no KEV listing and no EPSS score in the provided data, so widespread or active exploitation cannot be asserted. The vuln.today decision label is 'this_month', indicating a scheduled-remediation priority rather than act_now/emergency. The most security-relevant signal is qualitative, not numeric: the flaw lets requests cross IT/OT segmentation boundaries via a sanctioned application path, which raises its importance in OT/building-automation environments beyond what the 5.3 base score alone suggests.

An attacker lures an operator who is performing controller onboarding on a WIT SynApps Runtime instance into using an attacker-supplied target address; the operator's browser then issues discovery requests (e.g., to /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity) to loopback, internal hostnames, or otherwise unreachable OT hosts and can initiate the enrollment flow against internal REDY instances. A public PoC reference exists but is not verified as working exploit code, and success requires the victim to actively engage the onboarding workflow (UI:P).