Cyber Resilience

CVE-2026-1633

Critical

Published: 04 February 2026

Published
04 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0055 41.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-1633 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-1633 is a critical vulnerability in the Synectix LAN 232 TRIO 3-Port serial to ethernet adapter, published on 2026-02-04. The issue stems from the device's web management interface being exposed without any authentication requirements, allowing unauthenticated users to modify critical device settings or initiate a factory reset. It carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-306 (Missing Authentication for Critical Function).

Attackers with network access to the affected device can exploit this vulnerability without privileges or user interaction. Exploitation enables remote modification of essential configurations or a full factory reset, which could disrupt device functionality, alter network behavior, or facilitate further attacks on connected systems.

CISA has published advisory ICSA-26-034-04 addressing this vulnerability, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-04, along with the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-04.json. Security practitioners should consult these resources for recommended mitigations and patches.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication on the device's public web management interface directly enables remote exploitation of a critical function (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4810Shared CWE-306
CVE-2025-53847Shared CWE-306
CVE-2025-61757Shared CWE-306
CVE-2025-68715Shared CWE-306
CVE-2026-21992Shared CWE-306
CVE-2025-26362Shared CWE-306
CVE-2026-48692Shared CWE-306
CVE-2022-50981Shared CWE-306
CVE-2025-58083Shared CWE-306
CVE-2025-21515Shared CWE-306

Affected Assets

Cisa
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

preventdetect

AC-14 identifies and explicitly authorizes or limits functions without identification or authentication while requiring monitoring, directly mitigating the unauthenticated web management interface exposure.

prevent

IA-2 requires unique identification and authentication for organizational users, preventing unauthenticated access to critical device settings and factory reset functions.

prevent

AC-3 enforces approved authorizations for logical access to system resources, blocking unauthorized modifications and resets via the exposed interface.

References