CVE-2018-6909 A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by tr...
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rainmachine web application | All versions | No fix listed |
References
- www.irongeek.com exploit third-party-advisory