{"id":"CVE-2026-124577","published":"2026-11-09T08:17:02.350","lastModified":"2026-11-09T08:17:02.497","description":"A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://vuldb.com/cve/CVE-2026-124577","tags":[]},{"url":"https://vuldb.com/submit/1038184","tags":[]},{"url":"https://vuldb.com/vuln/432923","tags":[]},{"url":"https://vuldb.com/vuln/432923/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in Intelbras SG 2404 PoE L2+ switch firmware versions 1.00.70 and 1.00.72 allows improper authentication via an unknown function in the /EXCU_SHELL web management interface, enabling remote attackers to bypass authentication controls. This critical weakness (CVSS 9.8) permits full confidentiality, integrity, and availability compromise.","exploitability":"The exploit is publicly available and requires no privileges or user interaction, making exploitation trivial for remote attackers over the network.","blast_radius":"Successful exploitation could allow full compromise of the device—including unauthorized configuration changes, data exfiltration, or service disruption—with potential cascading impact on downstream network segments relying on the switch.","remediation":"Upgrade to firmware version 1.00.74 or later, as explicitly stated in the description to resolve the vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web-interface","ics","network-device","critical"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:44:22.481Z"}}