CVE-2026-24789
Published: 11 February 2026
Description
An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification of and restrictions on user actions performable without authentication, prohibiting unprotected API endpoints for critical functions like password changes.
Enforces approved authorizations for access to system resources, preventing unauthenticated remote modifications to device passwords via API endpoints.
Limits access to privileged functions such as password changes to explicitly authorized users, roles, or processes, mitigating unauthorized API exploitation.
Security SummaryAI
CVE-2026-24789 is a vulnerability involving an unprotected API endpoint that allows an attacker to remotely change the device password without providing authentication. Mapped to CWE-306 (Missing Authentication for Critical Function), it affects an unspecified device component and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-02-11.
An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation enables remote password modification, resulting in high impacts to confidentiality, integrity, and availability.
CISA ICS Advisory ICSA-26-041-02 provides details on mitigation, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02 and in the associated CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-041-02.json. Vendor contact information is listed at https://www.zlmcu.com/en/contact_us.htm.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of an unprotected API endpoint to change device password directly enables exploitation of a public-facing application.