CVE-2026-70381
Received Received - Intake

Unauthenticated Access to Non-Public Resources in Web Server

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: ENISA

Description
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-70381
EUVD
EUVD-2026-110302

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an access-control vulnerability in the web server configuration of WolfVision devices. It allows unauthenticated attackers with network access to remotely view certain resources meant for on-device use only. These resources may include non-public content like screen-saver images or web interface assets, but do not provide credentials or administrative access.

Detection Guidance

Check web server access logs for unusual requests to restricted resources. Use tools like curl or wget to test if non-public resources are accessible remotely. Example: curl -I http://<device-ip>/restricted-path

Scan network for exposed web interfaces of affected WolfVision devices. Use nmap to identify open ports and services on the device IP.

Impact Analysis

An attacker could access non-public device content such as screen-saver images or interface assets. This may expose internal or sensitive information about the device or its usage, but does not allow credential theft or administrative control.

Mitigation Strategies

Restrict network access to the web interface using firewalls or VLANs. Update device firmware if a patch is available from WolfVision.

Disable remote access to non-public resources if not required. Monitor vendor advisories for official fixes or workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70381. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart