CVE-2026-18965
Received Received - Intake

PayRange API Unauthorized Device Information Exposure

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: ICS-CERT

Description
PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-18965
EUVD
EUVD-2026-67312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
payrange payrange *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PayRange API lacks proper authorization on management endpoints, allowing public access to detailed information about every device on the PayRange network without requiring an account.

Impact Analysis

Remote attackers could access sensitive device details, modify settings to disrupt services, or change displayed images. This could lead to data breaches, operational disruptions, or unauthorized control of devices.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties if exposed data includes regulated information.

Mitigation Strategies

Minimize network exposure for PayRange devices by isolating them behind firewalls. Use secure remote access methods like VPNs to prevent unauthorized access. Avoid clicking unsolicited email links or attachments to reduce social engineering risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart