CVE-2026-108336
9.1CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-321
Impact
Unauthenticated attackers can bypass authentication and gain administrative control of the web interface if it uses the default self-signed SSL certificate. They need network access to the web UI, but cannot access customer data or device credentials directly.
Root cause
The web interface reuses the default self-signed SSL certificate's key to sign and validate session JWT tokens.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Replace the default self-signed SSL certificate on the web interface with a custom or CA-issued certificate, or restrict network access to the management web interface until resolved.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.