CVE-2026-1840

Deferred Deferred - Pending Action

Authentication Bypass in Aclara Metrum Cellular Web Interface

Publication date: 2026-06-24

Last updated on: 2026-06-25

Assigner: ICS-CERT

Description

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without restriction. Such unauthorized changes can disrupt normal functionality and, if performed repeatedly, may lead to a loss of communications to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-25

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-13

NVD

CVE-2026-1840

Affected Vendors & Products

Vendor	Product	Version / Range
aclara	metrum_cellular_web_interface	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Compliance Impact

The vulnerability allows unauthorized access to critical system functions due to the absence of authentication controls. This exposure can lead to unauthorized changes in configuration and system restarts, potentially disrupting normal device functionality and communications.

Such unauthorized access and control weaknesses could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of system integrity to safeguard sensitive data and ensure operational reliability.

Executive Summary

The Aclara Metrum Cellular Web Interface has a vulnerability due to the lack of authentication controls on critical system functions.

This means that unauthorized users can access essential configuration settings without any restrictions.

Attackers can alter operational parameters and trigger system restarts, potentially disrupting normal device functionality.

Impact Analysis

This vulnerability can lead to unauthorized changes in the device's configuration and repeated system restarts.

Such actions can disrupt normal functionality and may cause a loss of communications to the device.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to update the firmware to version 2.1.0.105, which can be downloaded from AclaraConnect.

Additionally, minimize network exposure for control system devices by isolating them from business networks.

Use secure remote access methods such as VPNs to access these devices.

Hi! I’m here to help you understand CVE-2026-1840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70