CVE-2026-15141
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests with an empty Referer value or omitting the header entirely may be accepted due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.
Risk Assessment
An attacker with access to the management interface could obtain sensitive configuration data, potentially leading to further attacks or security compromise.
Recommendation
Update the device firmware to a patched version. Additionally, consider strengthening request validation and restricting access to the management interface.
Original NVD description (English source)
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.