Description (CNA)
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CISA / Malcolm | affected 0 through 26.07.1; unaffected 26.08.0 |
CWE
CWE-352
References
- https://github.com/cisagov/Malcolm/security/advisories/GHSA-w8gq-4v5x-xrrm
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
ADP enrichment
No English description supplied.