CVE-2026-22096
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.
Risk Assessment
An attacker can access confidential data, including passwords, and upload malicious files, leading to a breach of system confidentiality and integrity.
Recommendation
Immediately implement authentication for the web server on port 8090 and restrict access to trusted networks only.
Other vulnerabilities in WebServer
See all- CVE-2026-22102Critical
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
- CVE-2026-22095Critical
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
- CVE-2026-1696Medium
The web server does not properly set some HTTP security headers in responses sent to client applications. This can weaken protection against attacks such as XSS, clickjacking, and other threats due to missing security headers.
Original NVD description (English source)
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.