CVE-2026-1632
Published: 03 February 2026
Summary
CVE-2026-1632 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-1632 is a missing authentication vulnerability (CWE-306) in MOMA Seismic Station Version v2.4.2520 and prior versions. The web management interface is exposed without requiring authentication, allowing unauthorized access to sensitive functions. Published on 2026-02-03T23:16:06.457, it has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.
An unauthenticated attacker with network access to the device can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables modification of configuration settings, acquisition of device data, or remote reset of the device, potentially leading to unauthorized control or data exfiltration in operational technology environments.
CISA has published ICS Advisory ICSA-26-034-03 addressing this vulnerability, with full details available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-03 and the corresponding CSAF JSON at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-03.json. Security practitioners should consult these advisories for recommended mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5358
Vulnerability details
MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on exposed web management interface directly enables remote exploitation of a public-facing application for unauthorized config changes, data access, and device control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification, authorization, and monitoring of actions permitted without authentication, preventing unauthorized configuration changes, data acquisition, and resets on the exposed web management interface.
Enforces approved access authorizations for system resources, ensuring the web management interface requires authentication before allowing sensitive operations.
Requires unique identification and authentication for organizational users, mitigating unauthenticated access to the vulnerable web management functions.