CVE-2026-1633
Published: 04 February 2026
Summary
CVE-2026-1633 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-1633 is a critical vulnerability in the Synectix LAN 232 TRIO 3-Port serial to ethernet adapter, published on 2026-02-04. The issue stems from the device's web management interface being exposed without any authentication requirements, allowing unauthenticated users to modify critical device settings or initiate a factory reset. It carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-306 (Missing Authentication for Critical Function).
Attackers with network access to the affected device can exploit this vulnerability without privileges or user interaction. Exploitation enables remote modification of essential configurations or a full factory reset, which could disrupt device functionality, alter network behavior, or facilitate further attacks on connected systems.
CISA has published advisory ICSA-26-034-04 addressing this vulnerability, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-04, along with the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-04.json. Security practitioners should consult these resources for recommended mitigations and patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5357
Vulnerability details
The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on the device's public web management interface directly enables remote exploitation of a critical function (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 identifies and explicitly authorizes or limits functions without identification or authentication while requiring monitoring, directly mitigating the unauthenticated web management interface exposure.
IA-2 requires unique identification and authentication for organizational users, preventing unauthenticated access to critical device settings and factory reset functions.
AC-3 enforces approved authorizations for logical access to system resources, blocking unauthorized modifications and resets via the exposed interface.