CVE-2026-24728
CriticalSummary
Missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22. Remote attackers can access exposed administrative functionality without prior authentication.
Risk Assessment
An attacker can gain unauthorized access to administrative functions, potentially leading to system integrity compromise and unauthorized configuration changes.
Recommendation
It is recommended to immediately update Interinfo DreamMaker to version 2025/10/22 or later. Also, implement authentication for all critical endpoints.
Original NVD description (English source)
A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to access exposed administrative functionality without prior authentication.