CVE-2026-66887

Received Received - Intake

Authorization Bypass in Network Device Firmware

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ICS-CERT

Description

The affected products are missing authorization on state-changing CGIs and session checks are not performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-66887

EUVD

EUVD-2026-79952

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves affected products missing authorization checks on state-changing CGIs and failing to perform session validation. This means attackers could manipulate system states without proper authentication or session verification.

Impact Analysis

An attacker could exploit this to change system states, gain unauthorized access, or perform actions as if they were a legitimate user. This could lead to data breaches, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Implement strict access controls on state-changing CGIs and enforce session validation checks. Disable unnecessary CGI endpoints and apply network segmentation to limit exposure.

Hi! I’m here to help you understand CVE-2026-66887. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70