CVE-2026-8185
Deferred Deferred - Pending Action
Authentication Bypass in UGREEN CM933 Firmware

Publication date: 2026-05-09

Last updated on: 2026-05-11

Assigner: VulDB

Description
A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-09
Last Modified
2026-05-11
Generated
2026-06-19
AI Q&A
2026-05-09
EPSS Evaluated
2026-06-18
NVD
CVE-2026-8185
EUVD
EUVD-2026-28909
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ugreen cm933 1.1.59.4319
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability can lead to unauthorized access to the device's administrative interface, potentially allowing an attacker to view or modify sensitive settings or data. This can compromise the confidentiality, integrity, and availability of the device and its network environment.

Executive Summary

This vulnerability affects the UGREEN CM933 device, specifically an unknown function within its Administrative Interface. The issue allows an attacker on the local network to bypass authentication, meaning they can access administrative functions without proper credentials.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the affected component, UGREEN CM933, to the fixed version scheduled for release in late April.

Since the attack requires being on the local network, limiting access to the administrative interface to trusted network segments can also help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart