CVE-2026-8185

Deferred Deferred - Pending Action

Authentication Bypass in UGREEN CM933 Firmware

Publication date: 2026-05-09

Last updated on: 2026-05-11

Assigner: VulDB

Description

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-09

Last Modified

2026-05-11

Generated

2026-07-09

AI Q&A

2026-05-09

EPSS Evaluated

2026-07-08

NVD

CVE-2026-8185

EUVD

EUVD-2026-28909

Affected Vendors & Products

Vendor	Product	Version / Range
ugreen	cm933	1.1.59.4319

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to unauthorized access to the device's administrative interface, potentially allowing an attacker to view or modify sensitive settings or data. This can compromise the confidentiality, integrity, and availability of the device and its network environment.

Executive Summary

This vulnerability affects the UGREEN CM933 device, specifically an unknown function within its Administrative Interface. The issue allows an attacker on the local network to bypass authentication, meaning they can access administrative functions without proper credentials.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the affected component, UGREEN CM933, to the fixed version scheduled for release in late April.

Since the attack requires being on the local network, limiting access to the administrative interface to trusted network segments can also help reduce risk.

Hi! I’m here to help you understand CVE-2026-8185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70