VulnerabilityAwaiting Analysis

CVE-2026-70381

An access-control vulnerability has been identified in the web server configuration.

MEDIUM 6.9EPSS —

Does this matter?

Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.

Description

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: No score yet
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-290
Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

References

https://wolfvision.com/de/security/cve-2026-70381-1

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.