Medium · published December 26, 2025
The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
| Product | Versions | Fixed in |
|---|---|---|
| etlsystems/d0116s1ula-22454_firmware | all versions | — |
| etlsystems/d0116s1uia-22474_firmware | all versions | — |
| etlsystems/c0401s1ula-22418_firmware | all versions | — |
| etlsystems/c0801s1ula-22420_firmware | all versions | — |
| etlsystems/c1601s1ula-22422_firmware | all versions | — |
| etlsystems/c0401s1ula-22455_firmware | all versions | — |
| etlsystems/c0801s1ula-22457_firmware | all versions | — |
| etlsystems/c1601s1ula-22459_firmware | all versions | — |
| etlsystems/c1601s1uia-22479_firmware | all versions | — |
| etlsystems/d0104d1ula-22411_firmware | all versions | — |
| etlsystems/d0108d1ula-22413_firmware | all versions | — |
| etlsystems/d0104d1ula-22451_firmware | all versions | — |
| etlsystems/d0108d1ula-22453_firmware | all versions | — |
| etlsystems/d0108d1uia-22473_firmware | all versions | — |
| etlsystems/c0401d1ula-22419_firmware | all versions | — |
| etlsystems/c0801d1ula-22421_firmware | all versions | — |
| etlsystems/c0401d1ula-22456_firmware | all versions | — |
| etlsystems/c0801d1ula-22458_firmware | all versions | — |
| etlsystems/c0401d1uia-22476_firmware | all versions | — |
| etlsystems/h0108d1ula-22431_firmware | all versions | — |
| etlsystems/h0104d1ula-22460_firmware | all versions | — |
| etlsystems/h0108d1ula-22461_firmware | all versions | — |
| etlsystems/d0104s1ula-22410_firmware | all versions | — |
| etlsystems/d0108s1ula-22412_firmware | all versions | — |
| etlsystems/d0116s1ula-22414_firmware | all versions | — |
| etlsystems/d0104s1ula-22450_firmware | all versions | — |
| etlsystems/d0108s1ula-22452_firmware | all versions | — |