CVE-2015-3950: Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote att...

Security readout for executives and security teams

This CVE describes a CSRF flaw in XZERES 442SR OS used on 442SR wind turbines. If an administrator is already authenticated, a remote attacker could cause requests that change the selected default admin user. The bundle does not provide CVSS, patch status, or confirmed impact beyond that behavior. Exposure is most likely where XZERES 442SR turbine administrative interfaces are reachable by administrators using browsers that may access untrusted content. The bundle does not identify versions, internet exposure, or deployment prevalence. Treat this as an operational technology exposure requiring asset confirmation first. Urgency rises if turbine administration is remotely reachable or shared with normal browsing activity. Evidence is incomplete, so remediation planning should start with vendor advisory review and exposure reduction. Mitigation focus: Review the referenced ICS-CERT advisory and vendor guidance for supported remediation.; Inventory any XZERES 442SR OS deployments and administrative access paths.; Restrict administrative interfaces to trusted management networks where operationally feasible..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.