CVE-2026-25084

Critical

Published: 11 February 2026

Published

11 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0013 32.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25084 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly prohibits permitted actions without identification or authentication for critical functions like internal URLs, addressing the core CWE-306 missing authentication issue.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access, preventing attackers from bypassing authentication via direct access to internal URLs.

IA-9 Service Identification and Authentication good match

prevent

Requires unique identification and authentication of system services exposed via internal URLs, mitigating unauthenticated remote access exploits.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-25084 enables remote authentication bypass via direct access to internal URLs on a network-accessible device, directly facilitating exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

Deeper analysisAI

CVE-2026-25084 is a critical authentication bypass vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting the ZLAN5143D device. Published on 2026-02-11, it stems from CWE-306 (Missing Authentication for Critical Function), allowing attackers to circumvent authentication by directly accessing internal URLs.

Remote, unauthenticated attackers with network access to the device can exploit this vulnerability with low complexity and no user interaction. Successful exploitation grants high-impact access, enabling confidentiality breaches, integrity modifications, and availability disruptions on the affected ZLAN5143D component.

CISA has issued ICS Advisory ICSA-26-041-02 detailing the issue, available at cisa.gov and in CSAF format on GitHub. Additional guidance may be obtained via the manufacturer's contact page at zlmcu.com/en/contact_us.htm.