Advisory Summary

Addressed a security concern where a device API endpoint was missing access controls. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This was addressed by enforcing token-based authentication on the corresponding endpoint to avoid unauthorized information disclosures.

CVE Number: CVE-2023-22813