CVE-2026-24789
Published: 11 February 2026
Summary
CVE-2026-24789 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-24789 is a vulnerability involving an unprotected API endpoint that allows an attacker to remotely change the device password without providing authentication. Mapped to CWE-306 (Missing Authentication for Critical Function), it affects an unspecified device component and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-02-11.
An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation enables remote password modification, resulting in high impacts to confidentiality, integrity, and availability.
CISA ICS Advisory ICSA-26-041-02 provides details on mitigation, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-041-02 and in the associated CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-041-02.json. Vendor contact information is listed at https://www.zlmcu.com/en/contact_us.htm.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5941
Vulnerability details
An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of an unprotected API endpoint to change device password directly enables exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification of and restrictions on user actions performable without authentication, prohibiting unprotected API endpoints for critical functions like password changes.
Enforces approved authorizations for access to system resources, preventing unauthenticated remote modifications to device passwords via API endpoints.
Limits access to privileged functions such as password changes to explicitly authorized users, roles, or processes, mitigating unauthorized API exploitation.