CVE-2026-32646
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A specific administrative endpoint is accessible without proper authentication, exposing device management functions. Lack of access control allows unauthorized users to access sensitive operations.
Risk Assessment
The risk includes unauthorized takeover of the device, configuration modification, or access to confidential data, potentially leading to full system compromise.
Recommendation
Immediately implement authentication for all administrative endpoints, e.g., by adding identity verification mechanisms (tokens, passwords) or configuring a firewall to restrict access.
Other vulnerabilities in Unknown device
See all- CVE-2025-41732Critical
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers, leading to full device compromise.
- CVE-2025-41730Critical
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
- CVE-2025-41734Critical
An unauthenticated remote attacker can execute arbitrary PHP files and gain full access to the affected devices.
- CVE-2025-41733Critical
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Original NVD description (English source)
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.