CVE-2026-102110

Received Received - Intake

Unauthenticated Privileged Activation in Appliance Setup

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disrupt setup and leave the appliance in an incompletely configured state. The issue is only reachable while an appliance is being activated for the first time and not yet fully configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102110

EUVD

EUVD-2026-90309

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves an endpoint used during initial appliance setup that lacked authentication requirements and failed to enforce its intended state precondition. An unauthenticated attacker could repeatedly trigger the privileged activation process during the initial setup window, disrupting the setup and leaving the appliance in an incompletely configured state.

Detection Guidance

This vulnerability is only present during the initial appliance setup and activation window. Monitor network traffic for repeated activation attempts during this period. Check appliance logs for unauthenticated requests to the activation endpoint.

Impact Analysis

This vulnerability could allow an attacker to disrupt the initial setup of an appliance, potentially leaving it in a partially configured state. This might lead to operational issues or security gaps if the appliance is not properly activated.

Compliance Impact

This vulnerability could disrupt appliance setup and leave it in an incompletely configured state, potentially violating compliance requirements for secure initial configuration. Unauthenticated access during activation may lead to unauthorized changes, impacting data protection measures required by standards like GDPR or HIPAA.

Mitigation Strategies

Ensure the appliance is fully configured and activated before exposing it to any network. Disable or restrict access to the activation endpoint once setup is complete. Verify no unauthenticated activation attempts occurred during initial setup.

Hi! I’m here to help you understand CVE-2026-102110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70